Allow _content_type parameter (and any other "external" parameter) on this service
Role Hierarchy was missing. Now, a user can do all privileged for his role and the roles below