Spring Security: current users is used for authority