fix permitAll spring security in index.js with login user/test