Spring security returns 302 - spring-security

Question

We upgraded an application from Spring 3 to Spring 5 and now no matter what we do we get response 302 upon login.
I access /login.jsp and fill in username and password, and then click "Log in" to submit the form.
In Tomcat logs I see that the reponse status code is 302.
"POST /login HTTP/1.1" 302 -
security.xml
<global-method-security secured-annotations="enabled" />
<http auto-config='true' use-expressions="true">
<access-denied-handler error-page="/error403.jsp"/>
<intercept-url pattern="/css/**" access="permitAll" />
<intercept-url pattern="/js/**" access="permitAll" />
<intercept-url pattern="/images/**" access="permitAll" />
<intercept-url pattern="/login.jsp" access="permitAll" />
<intercept-url pattern="/reset-password/**" access="permitAll" />
<intercept-url pattern="/checkAuth.tok*" access="permitAll" />
<intercept-url pattern="/activationStatus.tok*" access="permitAll" />
<intercept-url pattern="/renewAuth.tok*" access="permitAll" />
<intercept-url pattern="/reset-password*" access="permitAll" />
<intercept-url pattern="/reset-password/*" access="permitAll" />
<intercept-url pattern="/login" access="permitAll"/>
<intercept-url pattern="/**" access="isAuthenticated()"/>
<form-login authentication-success-handler-ref="refererHandler"
login-processing-url="/login"
login-page="/login.jsp" default-target-url="/firms-log-event"
authentication-failure-url="/login.jsp?error=true"/>
<logout logout-url="/logout" logout-success-url="/login.jsp" />
<anonymous username="guest" granted-authority="ROLE_ANONYMOUS" />
<csrf disabled="true"/>
<remember-me />
</http>
<beans:bean
class="portal.web.security.RefererRedirectionAuthenticationSuccessHandler"
name="refererHandler"/>
login.jsp:
<form id="login" action="<c:url value="/login" />"
method="post" onsubmit="DoSubmit();" name="login-form">
<fieldset>
<legend>Please enter your login credentials:</legend>
<c:if test="${not empty param.error}">
<div class="error">
${sessionScope["SPRING_SECURITY_LAST_EXCEPTION"].message}</div>
</c:if>
<ol>
<li><label for="user-id">user-id</label> <input id="user-id"
class="inputbox" type="text"
maxlength="<%=String.valueOf(ValidatorUtil.MAX_NAMES_SIZE)%>"
name="username" /> <input id="user-real-id" class="inputbox"
type="hidden"
maxlength="<%=String.valueOf(ValidatorUtil.MAX_NAMES_SIZE)%>"
name="j_username" /></li>
<li><label for="password">password</label> <input
id="password" class="inputbox" type="password"
maxlength="<%=String.valueOf(ValidatorUtil.MAX_NAMES_SIZE)%>"
name="j_password" /></li>
<li><label for="firmAdmin">firm admin</label> <input
id="firmAdmin" type="checkbox" checked="checked"></li>
<li><input class="submit greybutton" type="submit"
value="Submit" name="Submit"></li>
<li>
<p class="forgot-pass">
forgot your password? <a href="/reset-password">reset
password.</a>
</p>
</li>
</ol>
</fieldset>
<input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/>
</form>
RefererRedirectionAuthenticationSuccessHandler.java:
import org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler;
/**
*
*/
public class RefererRedirectionAuthenticationSuccessHandler
extends SimpleUrlAuthenticationSuccessHandler
{
/**
*
*/
public RefererRedirectionAuthenticationSuccessHandler()
{
super();
setUseReferer(true);
}
}
We must be missing something and any help would be highly appreciated