small change in SpringSecurity.xml: blocked pages when not logged in