update to spring security configuration