New authorization mechanism, @Secured annotation accepts array of roles