- spring security added
- landing page is /login.html
- on login success - redirect to /index.html
- on login failure - redirect to /403.html
- when on /index.html, if logout - redirect to /login.html and
invalidate session