cleaned up spring-security.xml to use security as default
added authorization check by database