I have Spring Security set up in a spring-boot app. I can add @PreAuthorize annotations to check author