XD-2122: Use roles for security access

Chose to leave ROLE_ADMIN for pure management access. CRUD access is ROLE_CREATE and simple R access is named ROLE_VIEW