REST + Spring Security + Java Config