Basic Spring Security setup

/secure/** is now secured by Spring Security (but no user handling yet)