Spring Security: both form-login and http-basic authentication