Spring security before authentication filter