Removed much deprecated content. Security should be done so that authorizing of operations follows role guidelines. UI related controllers now run under web/ path and external API controllers run under api/ path. There's an APIKey based authentication and authorization for API operations. All in all security and clean up related stuff.
Solved merge conflicts, added detection for user missing minimum required permission level.