Make sure the Spring Security integration performance does not suffer from the switch from SOAP to REST. There are some cache classes (com.atlassian.crowd.service.cache.CachingUserManager, CachingGroupMembershipManager and CachingGroupManager) that are coupled to the SOAP API and may need to be adapted or replaced when the implementation moves to REST.