"User level"?

a) Consider whether what you are doing is evil. (Letting only moderators
delete or edit posts other than their own? Good. Letting only people who
paid a premium read some content on your site or see real-time instead
of delayed information? Evil. Artificial scarcity is the root of all
evil...well, a lot of 21st century evil so far, anyway.) If it is evil,
redesign and refactor out the evil. At minimum, encapsulate all evil
into its own module named abandonhopeyewhoenter.jar and access those
naughty classes through several layers of indirection, so that it will
be easy to exorcise the demons without a complete rewrite if (when) it
later is time to free everything that has zero marginal cost to you.
b) Read the docs. This is probably covered in the documentation for JSF,
whatever that is. If it's not,
c) A google search may do wonders. Failing that, you'll probably just
have to
d) Wait for a more helpful response here. :)

No. You should make multiple versions of the view and differentiate
them with server specific role registration and security-constraint
entries on the web.xml file.