update security.xml+ layour for logout, add login controller + jsp