Spring REST controllers replace servlets, CORS filter