using shiro instead of the spring security