How to fix "Often Misused: Spring Remote Service" - fortify

Question

I use Fortify for scanning code and got this problem by recommend
Recommendations: Utilize Spring Security and SSL to provide authentication, authorization, confidentiality and integrity.
So I'm trying to fix this problem by implement Spring Security and basic authentication from the example guide
http://www.jayway.com/2008/09/30/spring-remoting-with-security-and-ssl/
I will get spring configuration like this
---- Server Side Configurations ---
remote-server.xml
<bean name="/testService" class="org.springframework.remoting.caucho.HessianServiceExporter">
<property name="service" ref="testService" />
<property name="serviceInterface" value="example.TestService" />
</bean>
security-server.xml
<security:http auto-config="true">
<security:http-basic/>
<security:intercept-url pattern="/**" access="ROLE_ADMIN" />
</security:http>
<security:authentication-manager alias="authenticationManager">
<security:authentication-provider>
<security:user-service id="uds">
<security:user name="testUser" password="testPassword" authorities="ROLE_ADMIN, ROLE_MANAGER" />
</security:user-service>
</security:authentication-provider>
</security:authentication-manager>
web.xml
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy
</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
--- Client Side Configurations ---
remote-client.xml
<bean id="rcaRemotingService" class="org.springframework.remoting.caucho.HessianProxyFactoryBean">
<property name="serviceUrl" value="${endpoint.url}/testService"/>
<property name="serviceInterface" value="example.TestService"/>
<property name="username" value="${endpoint.user}"/>
<property name="password" value="${endpoint.password}"/>
</bean>
But it doesn't work, the tools always hilight the problem like this
Abstract: On line 5 of remoting-servlet.xml, the application exposes
spring beans as remote services. By default, these remote services do
not require authentication and information transferred to or from this
service is in clear text. This could allow an attacker to access
privileged operations or expose sensitive data.
Sink: remote-server.xml:5 null()
line 5: <bean name="/testService" class="org.springframework.remoting.caucho.HessianServiceExporter">
<property name="service" ref="testService" />
<property name="serviceInterface" value="example.TestService" />
</bean>