amend spring sercurity filter chain: apply only for admin