Spring boot crud project, use of dtos, general best practices, spring security, JWT and access control