migration to spring security (config, sql)