updating thymeleaf tags: sec:authorize