[OAuth2] Add more code in OAuth security.
- roles(ADMIN) == authorizes(ROLE_ADMIN) but cannot confusing it. (tomcat runtime error)