Move definition of MessageSource bean to ApplicationContext.

No functional changes.
Move SecurityConfig to its own special package.

No functional changes.