Zk and Spring validation

<?xml version="1.0" encoding="UTF-8"?>
<?init class="org.zkoss.zkplus.databind.AnnotateDataBinderInit"?>
<?variable-resolver class="org.zkoss.zkplus.spring.DelegatingVariableResolver"?>
<div height="100%" >
    <groupbox>
        <caption>Login</caption>
        <h:form id="f" name="f" action="j_spring_security_check" method="POST"
    xmlns:h="http://www.w3.org/1999/xhtml">
            <grid>
                <rows>
                    <row>User: 
                        <textbox id="u" name="j_username"/>
                    </row>
                    <row>Password: 
                        <textbox id="p" type="password" name="j_password"/>
                    </row>
                    <!--<row>
                        <checkbox id="r" name="_spring_security_remember_me"/>Don't ask for my password for two weeks
                    </row>-->
                    <row spans="2">
                        <hbox>
                            <h:input type="submit" value="Submit Query"/>
                            <h:input type="reset" value="Reset"/>
                        </hbox>
                    </row>
                </rows>
            </grid>
        </h:form>
    </groupbox>
</div>

<global-method-security pre-post-annotations="enabled">
        <!-- AspectJ pointcut expression that locates our "post" method and applies security that way
        <protect-pointcut expression="execution(* bigbank.*Service.post*(..))" access="ROLE_TELLER"/>
        -->
    </global-method-security>
 
    <http auto-config="true"  use-expressions="true">

        <intercept-url pattern="/folder/**" access="permitAll" />
        <form-login login-page="/folder/loginUser.zul" default-target-url="/index.zul"/>
        <intercept-url pattern="/**" access="isAuthenticated()"  />

    </http>
 
    <authentication-manager>
        <authentication-provider>
            <!--<password-encoder hash="md5"/>-->
            <user-service>
                <user name="tomas" password="america" authorities="ROLE_SUPERVISOR, ROLE_USER, ROLE_TELLER" />
                <user name="tomas2" password="america2" authorities="ROLE_USER,ROLE_TELLER" />
                <user name="tomas3" password="america3" authorities="ROLE_USER" />
            </user-service>
        </authentication-provider>
    </authentication-manager>

<!--SPRING -->
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>/WEB-INF/spring/*.xml</param-value>
    </context-param>
    
    <context-param>
        <param-name>menuConfig</param-name>
        <param-value>/WEB-INF/menus/</param-value>
    </context-param>


    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>

    <listener>
        <display-name>StartServletListener</display-name>
        <listener-class>com.sgp.core.web.listeners.StartServletListener</listener-class>
    </listener>

    <listener>
        <listener-class>org.springframework.web.context.request.RequestContextListener</listener-class>
    </listener>

<!--SPRING SECURITY-->
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>

    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>   
    </filter-mapping>
    
    <listener>
        <listener-class>
    org.springframework.security.web.session.HttpSessionEventPublisher
        </listener-class>
    </listener> 
    

    <!-- ZK -->
    <listener>
        <description>Used to clean up when a session is destroyed</description>
        <display-name>ZK Session Cleaner</display-name>
        <listener-class>org.zkoss.zk.ui.http.HttpSessionListener</listener-class>
    </listener>

    <servlet>
        <description>ZK loader for ZUML pages</description>
        <servlet-name>zkLoader</servlet-name>
        <servlet-class>org.zkoss.zk.ui.http.DHtmlLayoutServlet</servlet-class>
        <init-param>
            <param-name>update-uri</param-name>
            <param-value>/zkau</param-value>
        </init-param>
        <load-on-startup>1</load-on-startup>
    </servlet>
    
    <servlet-mapping>
        <servlet-name>zkLoader</servlet-name>
        <url-pattern>*.zul</url-pattern>
    </servlet-mapping>
    
    <servlet-mapping>
        <servlet-name>zkLoader</servlet-name>
        <url-pattern>*.zhtml</url-pattern>
    </servlet-mapping>

    <servlet>
        <description>The asynchronous update engine for ZK</description>
        <servlet-name>auEngine</servlet-name>
        <servlet-class>org.zkoss.zk.au.http.DHtmlUpdateServlet</servlet-class>
    </servlet>
    <servlet-mapping>
        <servlet-name>auEngine</servlet-name>
        <url-pattern>/zkau/*</url-pattern>
    </servlet-mapping>

    <welcome-file-list>
        <welcome-file>index.zul</welcome-file>
    </welcome-file-list>