use SecurityContextHolder to get the current pricipal's username
echo: take care of the http method
do not user placeholder to store log pattern
home.html is open to ROLE_USER
my own html form can be submitted by HTTP POST method