Add Spring security layer (for add/edit/delete: only available as admin) with static rights and digest http authentication. Think stateless.
Refactor spring security layer to work with a database