add RestSecurityCheckInterceptor to make rest security checks work

checkSecurity() in AbstractREST did not actually do anything...
use streams to build rolesArray
remove unnecessary AbstractResourceREST
remove unused fields