refactor (security config): configure spring security by annotation