<http auto-config="false" use-expressions="true" entry-point-ref="authenticationEntryPoint">
		<intercept-url pattern="/secure/extreme/**" access="hasRole('ROLE_SUPERVISOR')" />
		<intercept-url pattern="/secure/**" access="isAuthenticated()" />
		<!-- Disable web URI authorization, as we're using <global-method-security> 
			and have @Secured the services layer instead <intercept-url pattern="/listAccounts.html" 
			access="isRememberMe()" /> <intercept-url pattern="/post.html" access="hasRole('ROLE_TELLER')" 
			/> -->
		<intercept-url pattern="/images/**" access="permitAll" />
		<intercept-url pattern="/login.jsp" access="permitAll" />
		<intercept-url pattern="/**" access="isAuthenticated()" />

		<logout logout-success-url="/login.jsp?loggedout=true"/>
		<!-- replaced with custom FORM_LOGIN_FILTER
		<form-login login-page="/login.jsp" default-target-url="/app/home.htm"/> -->
		
		<remember-me />
		<!-- Uncomment to enable X509 client authentication support <x509 /> -->
		<!-- Uncomment to limit the number of sessions a user can have -->
		<!--session-management invalid-session-url="/timeout.jsp"> <concurrency-control 
			max-sessions="1" error-if-maximum-exceeded="true" /> </session-management -->
		<custom-filter ref="authenticationFilter" position="FORM_LOGIN_FILTER"/>
	</http>

	<beans:bean id="authenticationFilter"
		class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter">
		<beans:property name="authenticationManager" ref="myCustomAuthenticationManager" />
		<beans:property name="authenticationFailureHandler"
			ref="customAuthenticationFailureHandler" />
		<beans:property name="authenticationSuccessHandler"
			ref="customAuthenticationSuccessHandler" />
	</beans:bean>

	<!-- We just actually need to set the default failure url here -->
	<beans:bean id="customAuthenticationFailureHandler"
		class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
		<beans:property name="defaultFailureUrl" value="/login.jsp?authfailed=true" />
	</beans:bean>

	<!-- We just actually need to set the default target url here -->
	<beans:bean id="customAuthenticationSuccessHandler"
		class="org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler">
		<beans:property name="defaultTargetUrl" value="/app/home.htm" />
	</beans:bean>

	<!-- The AuthenticationEntryPoint is responsible for redirecting the user 
		to a particular page, like a login page, whenever the server sends back a 
		response requiring authentication -->
	<!-- See Spring-Security Reference 5.4.1 for more info -->
	<beans:bean id="authenticationEntryPoint"
		class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
		<beans:property name="loginFormUrl" value="/login.jsp" />
	</beans:bean>

	<authentication-manager alias="authenticationManager" />