@RequestMapping(value = "/login", method = RequestMethod.GET)
	public ModelAndView login(@RequestParam(value = "error", required = false) String error,
			@RequestParam(value = "logout", required = false) String logout) {
		ModelAndView model = new ModelAndView();
		if (logout != null) {
			model.addObject("msg", "You've been logged out successfully.");
		}
		model.setViewName("login");
		return model;
	}

<form-login 
login-page="/login" 
default-target-url="/welcome" 
authentication-failure-url="/login?error" 
username-parameter="username"
password-parameter="password" />
<logout logout-success-url="/login?logout"  />
<csrf/>

<form name='loginForm' action="<c:url value='/j_spring_security_check' />" method='POST'>
    ...
    <input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}" />
</form>