bug fix, and changed from using <% out << ... %> to ${ ... }
update Spring Security to 3.2.1.RELEASE