How Spring Security Authentication Works