can exercise spring security components without database
started role based security testing
changed to parameterized tests
security can deny url access by role
can authorize by role