<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
		http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
		http://www.springframework.org/schema/security
		http://www.springframework.org/schema/security/spring-security.xsd">

	<global-method-security pre-post-annotations="enabled" />

	<http use-expressions ="true">
		<intercept-url pattern="/users**" access="hasRole('ROLE_ADMIN')" />
		<intercept-url pattern="/users/**" access="hasRole('ROLE_ADMIN')" />
		<intercept-url pattern="/account**" access="hasRole('ROLE_USER')" />
		<form-login login-page="/login.html"/>
		<logout logout-url="/logout" />
	</http>

	<authentication-manager>
	<authentication-provider>

		<password-encoder hash="bcrypt" />

		<jdbc-user-service data-source-ref="dataSource"
			authorities-by-username-query="select app_user.name, role.name from app_user
											join app_user_role on app_user.id = app_user_role.users_id
											join role on app_user_role.roles_id = role.id
											where app_user.name = ?"
			users-by-username-query="select name, password, enabled from app_user where name = ?" />
	</authentication-provider>
	</authentication-manager>


</beans:beans>