http://localhost:8080/userapp/index.html#/login

protected void configure(HttpSecurity http) throws Exception {
    http
            .authorizeRequests()
            .antMatchers("/scripts/**").permitAll()
            .antMatchers("/styles/**").permitAll()
            .antMatchers("/index.html#/login").permitAll()
            .antMatchers("/index.html#/index").permitAll()
            .anyRequest().authenticated()
            .and()
            .formLogin()
            .usernameParameter("username")
            .passwordParameter("password")
            .loginPage("/index.html#/login")
            .permitAll()
            .and()
            .exceptionHandling()
            .accessDeniedPage("/Access_Denied")
            .and()
            .csrf()
            .disable();

}

<div class="jumbotron">
        <div class="container">
            <div class="col-sm-8 col-sm-offset-2">
                <div ng-class="{ 'alert': flash, 'alert-success': flash.type === 'success', 'alert-danger': flash.type === 'error' }" ng-if="flash" ng-bind="flash.message"></div>
                <div ng-view></div>
            </div>
        </div>
    </div>

function config($routeProvider, $httpProvider) {
        $routeProvider.when('/index', {
            controller: 'HomeController',
            templateUrl: 'home.view.html',
            controllerAs: 'vm'
        })
            .when('/login', {
                controller: 'LoginController',
                templateUrl: 'login.view.html',
                controllerAs: 'vm'
            })
            .otherwise({
                redirectTo: '/login'
            });
        $httpProvider.defaults.headers.common["X-Requested-With"] = 'XMLHttpRequest';
    }
    config.$inject = [
        '$routeProvider', '$httpProvider'
    ];