Spring Security Access Control Allow Credentials