spring security bug fix