Move @PreAuthorize annotations in service layer #4