Enable OpenEntityManagerInViewInterceptor again.
Cleanup.
Set login/logout url, exception handlers and default permission for accessing any /api/** resource.
Add link to CSRF docu. We have to enable that in the future.