SEC-2783: XML Configuration Defaults Should Match JavaConfig

* j_username -> username
* j_password -> password
* j_spring_security_check -> login
* j_spring_cas_security_check -> login/cas
* j_spring_cas_security_proxyreceptor -> login/cas/proxyreceptor
* j_spring_openid_security_login -> login/openid
* j_spring_security_switch_user -> login/impersonate
* j_spring_security_exit_user -> logout/impersonate
* login_error -> error
* use-expressions=true by default

samples/ldap-xml/src/main/webapp/WEB-INF/applicationContext-security.xml

@@ -5,9 +5,9 @@
     http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">
 
     <s:http>
-        <s:intercept-url pattern="/secure/extreme/**" access="ROLE_SUPERVISOR"/>
-        <s:intercept-url pattern="/secure/**" access="IS_AUTHENTICATED_REMEMBERED" />
-        <s:intercept-url pattern="/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
+        <s:intercept-url pattern="/secure/extreme/**" access="hasRole('ROLE_SUPERVISOR')"/>
+        <s:intercept-url pattern="/secure/**" access="authenticated" />
+        <s:intercept-url pattern="/**" access="permitAll" />
 
         <s:form-login />
         <s:anonymous />

samples/ldap-xml/src/main/webapp/secure/extreme/index.jsp

@@ -7,7 +7,7 @@
 This is a protected page. You can only see me if you are a supervisor.
 
 <p><a href="../../">Home</a>
-<form action="<c:url value="/j_spring_security_logout"/>" method="post">
+<form action="<c:url value="/logout"/>" method="post">
 <input type="submit" value="Logoff"/>
 <security:csrfInput/>
 </form>

samples/ldap-xml/src/main/webapp/secure/index.jsp

@@ -13,7 +13,7 @@ or if you've authenticated this session.<br><br>
 
 
 <p><a href="../">Home</a>
-<form action="<c:url value="/j_spring_security_logout"/>" method="post">
+<form action="<c:url value="/logout"/>" method="post">
 <input type="submit" value="Logoff"/> (also clears any remember-me cookie)
 <security:csrfInput/>
 </form>