Spring security - close but no cigar.