add spring security and made login.mustache verified before login