fix spring-security retailer urls