working version with spring security
remove startapp