<http pattern="/*css*" security="none" />
<http pattern="/login.jsp*" security="none" />
<http pattern="/loginB.jsp*" security="none" />

<http pattern="/B.*" auto-config="true" use-expressions="true">
    <intercept-url pattern="/B.html" access="hasRole('ROLE_USER')" />
    <intercept-url pattern="/B.logout" access="hasRole('ROLE_USER')" />
    <form-login login-page="/loginB.jsp" />
    <logout logout-url="/B.logout" logout-success-url="/loginB.jsp"
        delete-cookies="JSESSIONID" />
    <headers>
        <cache-control />
    </headers>
</http>

<http auto-config="true" use-expressions="true">
    <intercept-url pattern="/index*" access="hasRole('ROLE_USER')" />
    <form-login login-page="/login.jsp" />
    <logout logout-url="/logout" logout-success-url="/login.jsp"
        delete-cookies="JSESSIONID" />
    <headers>
        <cache-control />
    </headers>
</http>
<authentication-manager>
    <authentication-provider>
        <password-encoder hash="bcrypt"></password-encoder>
        <jdbc-user-service data-source-ref="dataSource"
            authorities-by-username-query="select user_account, role from user_role where user_account = ?"
            users-by-username-query="select user_account, password, enabled from user where user_account = ?" />
    </authentication-provider>
</authentication-manager>