Recently I was overlooking my controllers and they are bit of mess.
You can use Acegi Security for authentication and authorization; it uses ServletFilters that intercept servlet requests and is configured within the Spring application context, using dependency injection and AOP. Check it ...