Previously the application displayed sign out from initial which was a link rather than a form. Remove Sign Out from initial while displaying proper Sign Out setup
Use EnableWebMvcSecurity and remove explicit CSRF tokens
Display the current user
Provide error and success messages on the login page