- catch predefined usernames (don't put them to the DB),
- userDetailsService as one component
- distinguish 401 and 403