refactor - still having trouble with spring security