title: failureUrl and failureForwardUrl not working
body: <ol>
  <li><p>Failed login attempts displays the login page (.loginPage("/signin")) instead of .failureUrl("/signin-error").</p></li>
  <li><p>When application starts, displays an empty page (with words $END$) instead of login page ('/signin').</p></li>
  </ol>
  
  <p>Spring Security 4</p>
  
  <pre><code>    @Configuration
      @EnableWebSecurity
      public class SecurityConfig extends WebSecurityConfigurerAdapter {
      @Autowired
      @Qualifier("jpaAccountService")
      private AccountService accountService;
  
            public void  configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
  
              auth
                      .userDetailsService(userDetailsService())
                      .passwordEncoder(passwordEncoder());
  
            }
  
          @Override
           public void configure(WebSecurity web) throws Exception {
               web
                   .ignoring()
                       .antMatchers("/resources/**");
           }
  
          @Override
          protected void configure(HttpSecurity http) throws Exception {
              http
                      .csrf().requireCsrfProtectionMatcher(new DefaultRequiresCsrfMatcher())
                      .and()
                      .formLogin()
                      .usernameParameter("username")
                      .passwordParameter("password")
                      .loginPage("/signin")
                      .loginProcessingUrl("/authenticate")
                      .failureUrl("/signin-error")
                      .defaultSuccessUrl("/secure")
                      .permitAll()
                      .and()
                      .apply(new SpringSocialConfigurer())
                      .and()
                      .logout()
                      .logoutUrl("/signout")
                      .deleteCookies("JSESSIONID")
                      .logoutSuccessUrl("/signin")
                      .and()
                      .rememberMe()
                      .and()
                      .authorizeRequests()
                      .antMatchers("/resources/**","/register").permitAll()
                      .anyRequest().authenticated()
                      .and()
                      .sessionManagement()
                      .invalidSessionUrl("/")
                      .maximumSessions(1);
  
          }
           private static final class DefaultRequiresCsrfMatcher implements RequestMatcher {
                  private Pattern allowedMethods = Pattern.compile("^(GET|HEAD|TRACE|OPTIONS)$");
                  private RegexRequestMatcher unprotectedMatcher = new RegexRequestMatcher("/connect/yahoo", null);
                  /* (non-Javadoc)
                   * @see org.springframework.security.web.util.matcher.RequestMatcher#matches(javax.servlet.http.HttpServletRequest)
                   */
                  @Override
                  public boolean matches(HttpServletRequest request) {
                      if(allowedMethods.matcher(request.getMethod()).matches()){
                          return false;
                      }
  
                      return !unprotectedMatcher.matches(request);
                  }
              }
           @Bean(name = "authenticationManager")
           @Override
           public AuthenticationManager authenticationManagerBean() throws Exception {
               return super.authenticationManagerBean();
           }   
  
           @Bean(name="userDetailsService")
           @Override
           public UserDetailsService userDetailsService() {
              return new RepositoryUserDetailsService(accountService);
          }
  
          @Bean
          public SocialUserDetailsService socialUsersDetailService() {
              return new SimpleSocialUsersDetailService(userDetailsService());
          }
  
          @Bean
          public UserIdSource userIdSource() {
              return new AuthenticationNameUserIdSource();
          }
  
          @Bean
          public PasswordEncoder passwordEncoder() {
              return new BCryptPasswordEncoder(10);
          }
          @Bean
          public TextEncryptor textEncryptor() {
              return Encryptors.noOpText();
          }
  
      }
  </code></pre>
  
  <p>Controller</p>
  
  <pre><code>@RequestMapping(value = "/signin")
          public String signin(Model uiModel){
              uiModel.addAttribute("signupForm", new RegistrationForm());
              return "signin";
          }
  
      @RequestMapping("/signin-error")
      public String loginError(Model model) {
          model.addAttribute("loginError", true);
          uiModel.addAttribute("signupForm", new RegistrationForm());
          return "signin";
      }
  </code></pre>
  
  <p>Login Form</p>
  
  <pre><code>&lt;html xmlns="http://www.w3.org/1999/xhtml"
        xmlns:th="http://www.thymeleaf.org"
        xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity4"&gt;
  
  
      &lt;div sec:authorize="hasRole('ROLE_USER')"&gt;
          &lt;h1&gt;Logged In&lt;/h1&gt;
      &lt;/div&gt;
  
      &lt;div sec:authorize="isAnonymous()"&gt;
          &lt;p th:if="${loginError}" class="error"&gt;Wrong user or password&lt;/p&gt;
          &lt;div id="login"&gt;
              &lt;form name="loginForm" th:action="@{/authenticate}" method="post"&gt;
                  &lt;table&gt;
                      &lt;caption align="left"&gt;Login:&lt;/caption&gt;
                      &lt;tr&gt;
                          &lt;td&gt;Email Address:&lt;/td&gt;
                          &lt;td&gt;&lt;input type="text" name="username" value=""/&gt;&lt;/td&gt;
                      &lt;/tr&gt;
                      &lt;tr&gt;
                          &lt;td&gt;Password:&lt;/td&gt;
                          &lt;td&gt;&lt;input type="password" name="password" value="" /&gt;&lt;/td&gt;
                      &lt;/tr&gt;   
                      &lt;tr&gt;
                          &lt;td colspan="2" align="center"&gt;&lt;input name="submit" type="submit" value="Login"/&gt;&lt;/td&gt;
                       &lt;/tr&gt;
                 &lt;/table&gt;
  
                   &lt;input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/&gt;
  
             &lt;/form&gt;
          &lt;/div&gt;
      &lt;/div&gt;
  &lt;/html&gt;
  </code></pre>