controller tests cleanup
bounce spring version to 4.0, spring security to 3.2 and servlet api to 3.1
small test refactoring
update security and security tests
renames: security -> auth
security update - expressions
revoke edit access from regular user
remove edit capability form user's form