fix spring security bug