Add /login/** as permitAll so logout works properly