updated some notes on the TODOs and refactored the spring-security file
refactored the security to use filters in different chain configurations for login, logout, and other rest endpoints