added component scan to spring-security.xml, so all used beans are within the scope
removed the secure flag and the domain so the cookies are returned by the browser. the secure flag should be optional in the future for people who use secure channels