final fixes for spring security upgrade