added user roles to database and adjusted security to check for those roles
improved validation mechanism
removed all properties of session token entity for json serialization except the sessiontoken itself
simplified REST services by removing resource helpers
added REST API for users
REST API for users can now assign user roles
return HTTP status 403 instead of 401 in case the user is logged in but does not have on of the required roles