Activate security stuff
In Anlehnung an: http://www.layh.com/work/typo3-flow-typo3-fluid/tutorials/flow-registration-and-login.html

To use all the security stuff and the default password and username provider it has to be activated in the Settings.yaml
The authenticationStrategy is oneToken here, that means that one Token has to be authenticated to grant access.
The default provider for the authentication is PersistedUsernamePasswordProvider.
This authentication provider is shipped with Flow. Here you can also add your own provider if you want to.

Settings.yaml
TYPO3:
  Flow:
    security:
      enable: TRUE
      authentication:
        #authenticationStrategy: oneToken atLeastOneToken anyToken see: http://docs.typo3.org/flow/TYPO3FlowDocumentation/TheDefinitiveGuide/PartIII/Security.html#multi-factor-authentication-strategy
        authenticationStrategy: oneToken
        providers:
          DefaultProvider:
            provider: PersistedUsernamePasswordProvider

##http://docs.typo3.org/flow/TYPO3FlowDocumentation/TheDefinitiveGuide/PartIII/Security.html#access-control-lists
##TYPO3 Flow will always add the magic Everybody role, which you don't have to configure yourself. This role will also be present, if no account is authenticated.
##Likewise, the magic role Anonymous is added to the security context if a user is not authenticated.

## Admin hat alle Eigenschaften der Rolle User + die Admin Eigenschaften
roles:
  User: []
  Admin: ['User']

Flow: Routes.yaml
##
# Subroutes from the Adress package.
#
-
  name: 'Logintut'
  uriPattern: '<LoginSubroutes>'
  defaults:
    '@format': 'html'
  subRoutes:
    LoginSubroutes:
      package: 'JPG.Login'

Package: Routes.yaml
-
  name: 'Login Application Index'
  uriPattern: 'login'
  defaults:
    '@package': 'JPG.Login'
    '@controller': 'Secret'
    '@action': 'index'
    '@format': 'html'