setup spring security rules and store user credential in db