removed session-management from spring-security