Internal API security

plus some clean up of spring xml files
Tiny points: over -> instead of; wont -> won't