fix spring injection in security config