Added support for a "Spring controller whitelist" so that admins can grant non-super user access to other modules