Replaced JSPs with thymeleaf.
Added CSRF token to the login form
Changed login POST url
Added display of error message
Added security (but not oauth) to the OAuth server.
Added an index page.