Spring Boot Access Control Expose Headers