spring security without the websecurityconfigureradapter