separate spring security configuration
tests pass