Add Spring security layer (for add/edit/delete: only available as admin) with static rights and digest http authentication. Think stateless.