user should be redirected to login page after session timeout
added login-page="/login" to form-login
removed <security:http-basic /> from /api/** endpoints
Merge branch 'master' into bugfix/attachment