Users without kie-server role can access kie-server REST api

When deploying kie-server on Tomcat with LDAP Realm, I found that a user without `kie-server` role can access kie-server REST api, which is not consistent with document.