Delete authorities from user controller, it is managed by authentication manager, see: SecurityConfig.