Reactive Spring Security binding: principal projection, ReactiveSecurityContext access, and the URL policy enforcement point