last commit for v. 3 (right before switching to spring-security-config)