[Sprint: 40] XD-2122: Use roles for security access

Chose to leave ROLE_ADMIN for pure management access. CRUD access is ROLE_CREATE and simple R access is named ROLE_VIEW
I wonder if we shouldn't allow read access to 'ROLE_CREATE' as well, by default? While the current setup is semantically correct, in that reading and creating/updating/deleting are disjoint operations, so it makes sense to be configured separately, it may also make for more convoluted operation, since in a typical scenario, we will place the onus on the user to make sure that all users with the role CREATE will get the role VIEW as well. This may become especially convoluted also in the case of LDAP. 

Or, I'm wondering if we shouldn't rather have an addition element called 'groups', that would indicate sets of roles that associated with a certain group, which could be in turn, used to configure a org.springframework.security.core.authority.mapping.GrantedAuthoritiesMapper. This way, the original rules remain unchanged but we can have a configuration that states that an ADMINISTRATOR has 'ROLE_CREATE, ROLE_VIEW, ROLE_ADMIN', a USER has 'ROLE_VIEW' and a MANAGER has "ROLE_CREATE, ROLE_VIEW" - thus leaving only one value to be configured further in User Management.