corrected spring security config