Adding Role user and admin correctly in spring security