title: Spring Security session-management setting and IllegalStateException
body: <p>I'm trying to add <code>&lt;session-management&gt;</code> in my Spring Security namespace configuration so that I can provide a different message than the login page when the session times out.  As soon as I add it to my configuration it starts throwing "IllegalStateException: Cannot create a session after the response has been committed" when I access the app.</p>
  
  <p>I'm using Spring Security 3 and Tomcat 6.  Here's my configuration:</p>
  
  <pre><code>&lt;http&gt;
      &lt;intercept-url pattern="/go.htm" access="ROLE_RESPONDENT" /&gt;
      &lt;intercept-url pattern="/complete.htm" access="ROLE_RESPONDENT" /&gt;                          
      &lt;intercept-url pattern="/**" access="IS_AUTHENTICATED_ANONYMOUSLY" /&gt;
      &lt;form-login login-processing-url="/j_spring_security_check" 
                  login-page="/login.htm" 
                  authentication-failure-url="/login.htm?error=true" 
                  default-target-url="/go.htm"
      /&gt;      
      &lt;anonymous/&gt;
      &lt;logout logout-success-url="/logout_message.htm"/&gt;  
      &lt;session-management invalid-session-url="/login.htm" /&gt;     
  
  &lt;/http&gt;
  </code></pre>
  
  <p>Everything works great until I add in the <code>&lt;session-management&gt;</code> line. What am I missing?</p>