Using Spring Security for authentication and authorization