How spring security works internally