Конфиг секьюрити и контроллер

public class SecurityConfig extends WebSecurityConfigurerAdapter{
 
    @Autowired
   AdministrationServiceImpl administrationServiceImpl;
 
    @Autowired
    public void configAuthentication(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(administrationServiceImpl).passwordEncoder(passwordEncoder());
    }
 
    @Bean(name = "passwordEncoder")
    public PasswordEncoder passwordEncoder() {return new BCryptPasswordEncoder();}
 
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/admins/addgift").access("hasRole('ADMIN')")
                .antMatchers("/superconfidential*").access("hasRole('SUPERADMIN')")
                .and().formLogin().loginPage("/admins/add").permitAll().
                defaultSuccessUrl("/", false)
                .and().csrf().disable().
                sessionManagement().maximumSessions(100).sessionRegistry(sessionRegistry()).and()
                .and().logout().
                logoutUrl("/logout").logoutSuccessUrl("/").
                invalidateHttpSession(true).deleteCookies();
    }

@RestController
public class AdministrationController {
 
    @Autowired
    private AdministrationService service;
    @Autowired
    private GiftService serviceGift;
    @Autowired
    private MarkerService serviceMarker;
    @RequestMapping(value = "/admins/add", method = RequestMethod.POST, produces = "application/json")
    @ResponseBody
    public SessionHashPresentation addAdmin(@RequestBody AdministrationPresentation administrationPresentation) {
 
        return service.add(administrationPresentation.getLogin(),administrationPresentation.getPassword(),administrationPresentation.getFullnameClient());
 
    }
 
    @RequestMapping(value = "/admins/addgift", method = RequestMethod.POST, produces = "application/json")
    @ResponseBody
    public void addGift(@RequestBody Gift gift) {
        serviceGift.save(gift);
    }

@Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/admins/addgift").access("hasRole('ADMIN')")
                .antMatchers("/superconfidential*").access("hasRole('SUPERADMIN')")
                .and().formLogin().loginPage("/admins/add").permitAll().
                defaultSuccessUrl("/", false)
                .and().csrf().disable().
                sessionManagement().maximumSessions(100).sessionRegistry(sessionRegistry()).and()
                .and().logout().
                logoutUrl("/logout").logoutSuccessUrl("/").
                invalidateHttpSession(true).deleteCookies();

@RequestMapping(value = "/admins/auot", method = RequestMethod.POST, produces = "application/json")
    @ResponseBody
    public void auot(@RequestParam login, @RequestParam password) {
        serviceAdministration.auot(login, password);
    }