How Spring Security certificate authentication works