More closely matching official docs on access control role configuration
User derives from AdvancedUserInterface now
Adding instructions to README about using auth header instead of cookies