title: spring security ignores authentication-failure-url
body: <p>I have the following spring security configuration:</p>
  
  <pre><code>&lt;security:http auto-config="true" use-expressions="false" entry-point-ref="httpStatusEntryPoint"&gt;
          &lt;security:custom-filter position="CONCURRENT_SESSION_FILTER" ref="concurrentSessionFilter"/&gt;
  
          &lt;security:form-login
                  authentication-success-handler-ref="authenticationSuccessHandler"
                  authentication-failure-url="/api/loginFailed"
          /&gt;
  
          &lt;security:intercept-url pattern="/api/**"/&gt;
          &lt;security:anonymous enabled="false"/&gt;
          &lt;security:logout logout-url="/logout" delete-cookies="JSESSIONID,sessionId"
                           success-handler-ref="logoutSuccessHandler"
          /&gt;
          &lt;security:csrf disabled="true"/&gt;
  
          &lt;security:session-management session-authentication-strategy-ref="sessionAuthenticationStrategy"/&gt;
  </code></pre>
  
  <p>I input wrong password and after it execution doesn't proceed in </p>
  
  <pre><code>@RequestMapping(value = "/loginFailed", method = RequestMethod.GET)
  @ResponseStatus(HttpStatus.UNAUTHORIZED)
  public String loginError(HttpServletRequest httpServletRequest) {
      return getErrorMessage(httpServletRequest, SPRING_SECURITY_LAST_EXCEPTION_KEY);
  }
  </code></pre>
  
  <p>What do I wrong ?</p>