http.sessionManagement() .maximumSessions(1) .sessionRegistry(sessionRegistry()) .expiredUrl("/login?expired");