mastered security annotations, even ran into problems with role voters; token manager separated, so far without interface