Configuring and using CustomWebSecurityExpressionHandler