security - added RoleOnly annotation and added to get all codes, checks if user has any of passed in roles in any of their group roles