Separating security into a part that depends only on the JPA and into a