authentication and authorization for gateway and based on Apache shiro