[Sprint: 40] XD-2122: Use roles for security access

Chose to leave ROLE_ADMIN for pure management access. CRUD access is ROLE_CREATE and simple R access is named ROLE_VIEW
I think that they're fine as they are just now - I believe that '/admin-ui/' is really the only one that was missed (but it's highly noticeable). 
But, overall, I think that having a catch-all rule at the end of the chain is not a bad idea, though.