<http auto-config="true" use-expressions="true">
        <intercept-url pattern="/login.do" access="permitAll()" />
        <intercept-url pattern="/WEB-INF" access="hasAnyRole('ROLE_ADMIN','ROLE_GUEST')" />

        <form-login login-page="/login.do"
                    username-parameter="username"
                    password-parameter="password"
                    login-processing-url="/j_spring_security_check"
                    default-target-url="/showUsers.do"
                    always-use-default-target="false"
                    authentication-failure-url="/login.do?param=error"/>

        <logout logout-url="/j_spring_security_logout"
                logout-success-url="/login.do?param=logout"
                invalidate-session="true"/>
        <csrf disabled="true"/>
    </http>