Spring Security 3.1 added features

http-delete-cookie.xml

<!-- Remove session cookie on logout -->
<http>
  <logout delete-cookies="JSESSIONID" />
</http>

http-error-if-maximum-exceeded.xml

<!-- Single session with blocking of second attempt --> 
<http>
    <session-management>
        <concurrency-control max-sessions="1" error-if-maximum-exceeded="true" />
    </session-management>
  </http>

http-stateless.xml

<!-- Multiple http element with stateful and stateless support -->
<http pattern="/restful/**" create-session="stateless">
  <intercept-url pattern='/**' access='ROLE_REMOTE' />
  <http-basic />
</http>

<!-- Empty filter chain for the login page -->
<http pattern="/login.htm*" security="none"/>

<!-- Additional filter chain for normal users, matching all other requests -->
<http>
  <intercept-url pattern='/**' access='ROLE_USER' />
  <form-login login-page='/login.htm' default-target-url="/home.htm"/>
  <logout />
</http>