[Sprint: 40] XD-2122: Use roles for security access

Chose to leave ROLE_ADMIN for pure management access. CRUD access is ROLE_CREATE and simple R access is named ROLE_VIEW
On a second thought, groups are the kind of enhancement we can always add later, so perhaps it should make the subject of a subsequent JIRA item - we will see how critical this in fact is. So perhaps we should leave the entire comment above for later.