not using commons-logging and introduce spring security