switch to mysql database
- basic login support
- make use of principal information in servlet requests
getPrincipal() works only once per method
role mappings