https://leweii.github.io/posts/spring-security-client-stateless/