Adds Spring security.

* Also, changes the configuration to XML-only. Hybrid configuration was
  getting tricky with Spring Security. Left for when the project is
  functional or it is really required.