changed forward back to redirect - it's better to redirect to ensure that cookies are deleted/updated/etc.
update to Spring Security 3.2.3.RELEASE