Configuring how Spring Security uses HttpSession