Remove Spring Security. Let the login info empty.
First running example, with following problem:

AUTH-Failure throws exception

SessionId at login.
Now wrong password works fine ;-)
Disable the sessionId at the login.
Understanding RememberMe.
Added functionality to easily disable authentication in develop.
Switch to hashed passwords.
Added a comment in the web.xml.
Added Thymeleaf-Shiro
Switch the securit from spring securit to shiro, which is better to
understand and debug and have a more sophisticated security approach.