Securing REST API with Spring Security OAuth2