Authorization issues (no slide):

The problem with the old RUS authorization structure was that only two roles
were defined (admin and regular user). This was too coarse grained. It would
also be interesting to restrict user access on certain fields.

This should be an implementation problem, the interface only needs you to be
able to do authorization.

In a GFD (see template) security should be addressed and for this application
access control is very important. 
Describe the set of problems, the section is informative, not normative.
Write about the problems in the security section, say that role based
access control should be supported.