a few changes to applicationContext-security.xml