change role to authority in UserRole
bump spring security to 3.2
add auth success and failure handlers