DO NOT MERGE - Use Spring security rather than Shiro.

Yep, it is slightly painful that the beans have to be in the root context.