Enable role hierarchy on web/http security level

Adapted the webapp archetype to use the role hierarchy also on web/http security level (and not only on method security level).

As we currently have defined the role hierarchy

ROLE_ADMIN > ROLE_USER

a user with exactly one granted authority ROLE_ADMIN will automatically have the ROLE_USER too and we don't have to care about such issues anymore (e.g. giving the ROLE_USER "manually" to every user with ROLE_ADMIN)