Simplify access rule configuration

By leveraging spring security access control expression we end up with
having only two rules to manage all current authz needs.