working through spring security configuration