a token's roles are immutable, so create a new one
remove trait from indexcontroller
add route security trait for acl shorthand
add example private controller