Simple CDI based @RolesAllowed using either HttpServlet or the EJB
session context to check roles again. WIP!