is it worth doing this with the security.yml setting or with annotations?

Like `@Security("has_role('ROLE_ADMIN')")` (http://symfony.com/doc/current/book/security.html#securing-a-controller)