introduce spring-security, refine user, role, user_role entities