Persisting auth token in spring security