updating the spring security code - to work with httpOnly auth (the rest spring security plugin is the way to go, but if you can't, you can get standard spring security to play nicely - but it takes some server config)