Securing REST API using Spring OAuth2