spring security musings