add missing property to model
fix privilege check for anonymous users.

Authentication objects for anonymous users don't have Role objects, but have SimpleGrantedAuthority objects instead. This caused a ClassCastException at line 22.
add some easy to forget info