added spring security, pwd are currently clear text, have to hash them