implement Spring security layer with static rights (HTTP)