integrated spring security, admin routes are behind a password