@Override
protected void configure(HttpSecurity http) throws Exception{
    http.authorizeRequests()
    .antMatchers("/").access("hasRole('ROLE_ADM') or hasRole('ROLE_VENDEDOR')")
    .antMatchers("/usuarios").access("hasRole('ROLE_ADM')")
    .antMatchers("/ventas").access("hasRole('ROLE_ADM') or hasRole('ROLE_VENDEDOR')")
    .antMatchers("/reportes").access("hasRole('ROLE_ADM')")
    .and().formLogin().loginPage("/login")
    .usernameParameter("user").passwordParameter("password")
    .and().csrf()
    .and().exceptionHandling().accessDeniedPage("/denied");
}