SEC-2436: Add @EnableWebMvcSecurity

docs/guides/src/asciidoc/hellomvc.asc

@@ -110,10 +110,25 @@ We can view the user name, but how are we able to log out? Below you can see how
     <input type="submit" value="Log out" />
 </form>
 ----
+
+If you try to log out right now the request will fail. The reason is that we have not enabled the Spring MVC integration. Update our configuration to use the `@EnableWebMvcSecurity` annotation instead.
+
+.src/main/java/org/springframework/security/samples/config/SecurityConfig.java
+[source,java]
+----
+import org.springframework.security.config.annotation.web.servlet.configuration.*;
+
+@Configuration
+@EnableWebMvcSecurity
+public class SecurityConfig extends WebSecurityConfigurerAdapter {
+----
+
 In order to help protect against http://en.wikipedia.org/wiki/Cross-site_request_forgery[CSRF attacks], by default, Spring Security Java Configuration log out requires:
 
 * the HTTP method must be a POST
-* the CSRF token must be added to the request. Since we are using Thymeleaf, the CSRF token is automatically added as a hidden input for you (view the source to see it). If you were not using Spring MVC or Thymeleaf, you can access the CsrfToken on the ServletRequest using the attribute _csrf
+* the CSRF token must be added to the request. Since we have used `@EnableWebMvcSecurity` and are using Thymeleaf, the CSRF token is automatically added as a hidden input for you (view the source to see it). If you were not using Spring MVC taglibs or Thymeleaf, you can access the CsrfToken on the ServletRequest using the attribute _csrf
+
+NOTE: `@EnableWebMvcSecurity` also adds `@EnableWebSecurity`, so there is no need to add both.
 
 Click the button and see that the application logs you out successfully.