Help with Authorization flow choice for Angular SPA & Spring API