auth with spring security
without web.xml

and using facet 3.0 (was 2.5)