Security v2 -> v3: Convert to use sec:intercept-url for mappings

Note: Only applicationContext.xml is used by the tests.  The others
are used by full cosmo server's web.xml, so will need some tweaking
if re-merged.