Spring authentication with Wicket authorization