Security changes

* Changes on REST layer to get only authorized resources on all methods
* Change spring security session to stateless