split up rest / services.
fixed roles.
complete replacing auth with shiro auth
updated status