moving from javaconfig to xml AND adding openId security