<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
  xmlns:beans="http://www.springframework.org/schema/beans"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://www.springframework.org/schema/beans
           http://www.springframework.org/schema/beans/spring-beans-4.1.xsd
           http://www.springframework.org/schema/security
           http://www.springframework.org/schema/security/spring-security-3.2.xsd">
                                            
    <http auto-config='true' >
        <intercept-url pattern="/index.htm*" access="ROLE_USER" />
        <form-login login-page='/login.htm' default-target-url='/index.htm' always-use-default-target='true' />
    
        <logout logout-success-url="/loggedout.htm"/>
    </http>
    
    <authentication-manager>
        <authentication-provider>
            <user-service>
                <user name="demouser" password="demopass" authorities="ROLE_USER, ROLE_ADMIN" />
                <user name="userdemo" password="passdemo" authorities="ROLE_USER" />
            </user-service>
        </authentication-provider>
    </authentication-manager>

</beans:beans>
<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
  xmlns:beans="http://www.springframework.org/schema/beans"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://www.springframework.org/schema/beans
           http://www.springframework.org/schema/beans/spring-beans-4.1.xsd
           http://www.springframework.org/schema/security
           http://www.springframework.org/schema/security/spring-security-3.2.xsd">
                                            
    <http auto-config='true' >
        <intercept-url pattern="/index.htm*" access="ROLE_USER" />
        <intercept-url pattern="/api/whisky/*" access="ROLE_USER" />
        <form-login login-page='/login.htm' default-target-url='/index.htm' always-use-default-target='true' />
    
        <logout logout-success-url="/loggedout.htm"/>
    </http>
    
    <authentication-manager>
        <authentication-provider>
            <user-service>
                <user name="demouser" password="demopass" authorities="ROLE_USER, ROLE_ADMIN" />
                <user name="userdemo" password="passdemo" authorities="ROLE_USER" />
            </user-service>
        </authentication-provider>
    </authentication-manager>

</beans:beans>
Put api behind spring security.
Put api behind spring security.