[Sprint: 40] XD-2122: Use roles for security access

Chose to leave ROLE_ADMIN for pure management access. CRUD access is ROLE_CREATE and simple R access is named ROLE_VIEW
Actually, I can fix this as part of the merge, as it's the only outstanding issue.