How to secure stateful rest-like backend with spring security. (WTF? Stateufil REST? Don't ask.)