1. A method of managing user access to application-specific capabilities of a computer system, comprising: maintaining data correlating application-specific capabilities for each of the applications of the computer system, wherein the application-specific capabilities of different applications are independent of each other; maintaining data correlating user identifiers with user roles; maintaining data correlating user roles with the application-specific capabilities; and managing user access to the application-specific capabilities of at least one of the applications of the computer system using a security information source, wherein the security information source includes at least one of: a security module or a user token, wherein the user token is generated according to credentials of a particular user and is presented to identify access of the particular user to particular ones of the application-specific capabilities of the at least one application for a period of time, and wherein the security module includes a security application programming interface for the computer system, wherein the security information source uses stored correlating data including the data correlating application-specific capabilities, the data correlating user identifiers, and the data correlating user roles, wherein managing user access further includes determining whether to access the security module, the user token or both to control access of the particular user to the application specific capabilities of the at least one application, wherein use of the security module, the user token or both to control the access of the particular user depends on the application specific capabilities being accessed, the determining further including: (i) when a first particular capability of the application specific capabilities specifies validation using the security module, accessing the security module to determine if the first particular capability is enabled for the particular user, and, if access is not enabled according to the security module, denying access; (ii) when a second particular capability of the application specific capabilities specifies validation using the user token, accessing the user token to determine if the second particular capability is enabled for the particular user and, if access is not enabled according to the user token, denying access; and (iii) when a third particular capability of the application specific capabilities is not specified as requiring validation by a specific one of the user token or the security module, accessing a first one of: the user token or the security module to determine if the third particular capability is enabled for the particular user, and, in response to the first one of: the user token or the security module indicating that the third particular capability is not enabled, accessing the other one of: the user token or the security module to determine if the third particular capability is enabled.