diff --git a/samples/tutorial-xml/src/main/webapp/WEB-INF/applicationContext-security.xml b/samples/tutorial-xml/src/main/webapp/WEB-INF/applicationContext-security.xml
index d2e64307bf..fc25528dbc 100644
--- a/samples/tutorial-xml/src/main/webapp/WEB-INF/applicationContext-security.xml
+++ b/samples/tutorial-xml/src/main/webapp/WEB-INF/applicationContext-security.xml
@@ -1,9 +1,9 @@
 <?xml version="1.0" encoding="UTF-8"?>
 
 <!--
-  - Sample namespace-based configuration
-  -
-  -->
+- Sample namespace-based configuration
+-
+-->
 
 <beans:beans xmlns="http://www.springframework.org/schema/security"
 	xmlns:beans="http://www.springframework.org/schema/beans"
@@ -19,12 +19,12 @@
 	<http pattern="/loggedout.jsp" security="none"/>
 
 	<http>
-		<intercept-url pattern="/secure/extreme/**" access="hasRole('supervisor')"/>
-		<intercept-url pattern="/secure/**" access="isAuthenticated()" />
+		<intercept-url pattern="/secure/extreme/**" access="hasAuthority('supervisor')"/>
+		<intercept-url pattern="/secure/**" access="authenticated" />
 		<!--
-			 Allow all other requests. In a real application you should
-			 adopt a whitelisting approach where access is not allowed by default
-		  -->
+			Allow all other requests. In a real application you should
+			adopt a whitelisting approach where access is not allowed by default
+		-->
 		<intercept-url pattern="/**" access="permitAll" />
 		<form-login />
 		<logout logout-success-url="/loggedout.jsp" delete-cookies="JSESSIONID"/>
diff --git a/samples/tutorial-xml/src/main/webapp/WEB-INF/jsp/listAccounts.jsp b/samples/tutorial-xml/src/main/webapp/WEB-INF/jsp/listAccounts.jsp
index 8bfdf99c47..74eaf5d3f7 100644
--- a/samples/tutorial-xml/src/main/webapp/WEB-INF/jsp/listAccounts.jsp
+++ b/samples/tutorial-xml/src/main/webapp/WEB-INF/jsp/listAccounts.jsp
@@ -1,13 +1,14 @@
 <%@taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
+<%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags" %>
 
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
 
 <html>
-  <head>
-      <meta http-equiv="content-type" content="text/html; charset=UTF-8">
-      <link rel="stylesheet" href="<c:url value='/static/css/tutorial.css'/>" type="text/css" />
-      <title>Accounts</title>
-  </head>
+<head>
+	<meta http-equiv="content-type" content="text/html; charset=UTF-8">
+	<link rel="stylesheet" href="<c:url value='/static/css/tutorial.css'/>" type="text/css" />
+	<title>Accounts</title>
+</head>
 <body>
 <div id="content">
 
@@ -32,22 +33,26 @@ Anyone can view this page, but posting to an Account requires login and must be
 <td><b>Operations</b></td>
 </tr>
 <c:forEach var="account" items="${accounts}">
-  <tr>
-  <td>${account.id}</td>
-  <td>${account.holder}</td>
-  <td>${account.balance}</td>
-  <td>${account.overdraft}</td>
-  <td>
-      <a href="post.html?id=${account.id}&amp;amount=-20.00">-$20</a>
-      <a href="post.html?id=${account.id}&amp;amount=-5.00">-$5</a>
-      <a href="post.html?id=${account.id}&amp;amount=5.00">+$5</a>
-      <a href="post.html?id=${account.id}&amp;amount=20.00">+$20</a>
-  </td>
-  </tr>
+<tr>
+<td>${account.id}</td>
+<td>${account.holder}</td>
+<td>${account.balance}</td>
+<td>${account.overdraft}</td>
+<td>
+	<a href="post.html?id=${account.id}&amp;amount=-20.00">-$20</a>
+	<a href="post.html?id=${account.id}&amp;amount=-5.00">-$5</a>
+	<a href="post.html?id=${account.id}&amp;amount=5.00">+$5</a>
+	<a href="post.html?id=${account.id}&amp;amount=20.00">+$20</a>
+</td>
+</tr>
 </c:forEach>
 </table>
 
-<p><a href="logout">Logout</a></p>
+<p>
+<form action="logout" method="post">
+	<sec:csrfInput />
+	<input type="submit" value="Logout"/>
+</form>
 </div>
 </body>
 </html>
diff --git a/samples/tutorial-xml/src/main/webapp/secure/extreme/index.jsp b/samples/tutorial-xml/src/main/webapp/secure/extreme/index.jsp
index 01b644bea2..6553fe6c84 100644
--- a/samples/tutorial-xml/src/main/webapp/secure/extreme/index.jsp
+++ b/samples/tutorial-xml/src/main/webapp/secure/extreme/index.jsp
@@ -1,25 +1,29 @@
-<%@ taglib prefix="authz" uri="http://www.springframework.org/security/tags" %>
+<%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags" %>
 <%@taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
 
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
 
 <html>
-  <head>
-      <meta http-equiv="content-type" content="text/html; charset=UTF-8">
-      <link rel="stylesheet" href="<c:url value='/static/css/tutorial.css'/>" type="text/css" />
-      <title>Secure Page</title>
-  </head>
+<head>
+	<meta http-equiv="content-type" content="text/html; charset=UTF-8">
+	<link rel="stylesheet" href="<c:url value='/static/css/tutorial.css'/>" type="text/css" />
+	<title>Secure Page</title>
+</head>
 <body>
 <div id="content">
 <h1>VERY Secure Page</h1>
 This is a protected page. You can only see me if you are a supervisor.
 
-<authz:authorize access="hasRole('supervisor')">
-   You have authority "supervisor" (this text is surrounded by &lt;authz:authorize&gt; tags).
-</authz:authorize>
+<sec:authorize access="hasAuthority('supervisor')">
+You have authority "supervisor" (this text is surrounded by &lt;sec:authorize&gt; tags).
+</sec:authorize>
 
 <p><a href="../../">Home</a></p>
-<p><a href="../../logout">Logout</a></p>
+
+<form action="../../logout" method="post">
+	<sec:csrfInput />
+	<input type="submit" value="Logout"/>
+</form>
 </div>
 </body>
 </html>
diff --git a/samples/tutorial-xml/src/main/webapp/secure/index.jsp b/samples/tutorial-xml/src/main/webapp/secure/index.jsp
index 4b7455abde..e41003a808 100644
--- a/samples/tutorial-xml/src/main/webapp/secure/index.jsp
+++ b/samples/tutorial-xml/src/main/webapp/secure/index.jsp
@@ -4,11 +4,11 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
 
 <html>
-  <head>
-      <meta http-equiv="content-type" content="text/html; charset=UTF-8">
-      <link rel="stylesheet" href="<c:url value='/static/css/tutorial.css'/>" type="text/css" />
-      <title>Secure Page</title>
-  </head>
+<head>
+	<meta http-equiv="content-type" content="text/html; charset=UTF-8">
+	<link rel="stylesheet" href="<c:url value='/static/css/tutorial.css'/>" type="text/css" />
+	<title>Secure Page</title>
+</head>
 <body>
 <div id="content">
 
@@ -19,7 +19,7 @@ or if you've authenticated this session.
 </p>
 <p>
 <sec:authorize access="hasRole('supervisor')">
-    You are a supervisor! You can therefore see the <a href="extreme/index.jsp">extremely secure page</a>.<br/><br/>
+	You are a supervisor! You can therefore see the <a href="extreme/index.jsp">extremely secure page</a>.<br/><br/>
 </sec:authorize>
 </p>
 <h3>Properties obtained using &lt;sec:authentication /&gt; tag</h3>
@@ -43,7 +43,11 @@ or if you've authenticated this session.
 
 
 <p><a href="../">Home</a></p>
-<p><a href="../logout">Logout</a></p>
+
+<form action="../logout" method="post">
+	<sec:csrfInput />
+	<input type="submit" value="Logout"/>
+</form>
 </div>
 </body>
 </html>
