thymeleaf custom layout and spring security