Fixing Spring Security for CORS