code: @Override
      protected final void configure(final HttpSecurity http) throws Exception {
          http.authorizeRequests().antMatchers("/**").permitAll().anyRequest()
                  .authenticated();
  
          // TODO haven't figured out how to retain referer after login error.
          final SavedRequestAwareAuthenticationSuccessHandler handler =
                  new SavedRequestAwareAuthenticationSuccessHandler();
          handler.setDefaultTargetUrl(servletPath + "/person?db=schoeller&id=I1");
          handler.setAlwaysUseDefaultTargetUrl(false);
          handler.setTargetUrlParameter("targetUrl");
  
          http.formLogin().loginPage(servletPath + "/login")
                  .successHandler(handler)
                  .permitAll();
          http.logout().deleteCookies("JSESSIONID").invalidateHttpSession(true)
                  .logoutUrl(servletPath + "/logout")
                  .logoutSuccessUrl(servletPath + "/login").permitAll();
      }
docs: {@inheritDoc}