diff --git a/itest/web/src/main/webapp/WEB-INF/http-security.xml b/itest/web/src/main/webapp/WEB-INF/http-security.xml
index 530414d37c..55a6d931d9 100644
--- a/itest/web/src/main/webapp/WEB-INF/http-security.xml
+++ b/itest/web/src/main/webapp/WEB-INF/http-security.xml
@@ -22,7 +22,9 @@
         <!-- Default logout configuration -->
         <logout logout-url="/logout"/>
 
-        <concurrent-session-control max-sessions="1" />
+        <session-management>
+            <concurrency-control max-sessions="1" />
+        </session-management>        
 
         <remember-me key="doesntmatter" token-repository-ref="tokenRepo"/>
     </http>
diff --git a/samples/tutorial/src/main/webapp/WEB-INF/applicationContext-security.xml b/samples/tutorial/src/main/webapp/WEB-INF/applicationContext-security.xml
index cf5f5b61c3..f97a024a7e 100644
--- a/samples/tutorial/src/main/webapp/WEB-INF/applicationContext-security.xml
+++ b/samples/tutorial/src/main/webapp/WEB-INF/applicationContext-security.xml
@@ -34,16 +34,27 @@
         <x509 />
 -->
         <!-- Uncomment to limit the number of sessions a user can have -->
-        <concurrent-session-control max-sessions="1" exception-if-maximum-exceeded="true"/>
+        <session-management>
+            <concurrency-control max-sessions="1" error-if-maximum-exceeded="true" />
+        </session-management>
 
     </http>
 
+    <!--
+    Usernames/Passwords are
+        rod/koala
+        dianne/emu
+        scott/wombat
+        peter/opal
+    -->
     <authentication-manager>
         <authentication-provider>
+            <password-encoder hash="md5"/>
             <user-service>
-                <user name="joe" password="password" authorities="ROLE_JANITOR" />
-                <user name="jim" password="password" authorities="ROLE_TRADER" />                
-                <user name="jane" password="password" authorities="ROLE_SUPERVISOR" />
+                <user name="rod" password="a564de63c2d0da68cf47586ee05984d7" authorities="ROLE_SUPERVISOR, ROLE_USER, ROLE_TELLER" />
+                <user name="dianne" password="65d15fe9156f9c4bbffd98085992a44e" authorities="ROLE_USER,ROLE_TELLER" />
+                <user name="scott" password="2b58af6dddbd072ed27ffc86725d7d3a" authorities="ROLE_USER" />
+                <user name="peter" password="22b5c9accc6e1ba628cedc63a72d57f8" authorities="ROLE_USER" />
             </user-service>
         </authentication-provider>
     </authentication-manager>