added Spring security config, no real auth yet