Minor progress with Spring Security