updated "private" website and restricted /api/user 

writing documentation for Spring Security