https://kiryanchi.github.io/posts/spring-security-architecture/