Authentication-and-Authorization-without-Spring-Security authentication and authorization without spring security