Add PreAuthorize annotation to a method.

The method (getUserIdFromSession) is -- probably erroneously --
being called directly from a controller.

A follow up commit should remove this annotation and instead
introduce a dedicated and secured method in the correct
service.