* enable method security with custom authorization manager * fix: pmd violation * fix: add user builder, clean code * fix: test name when forbidden, user map variable
