Spring security custom user token based authenticator