After ignoring this problem a little time I still have no solution to fix this. I implemented my own extension of PersistedUsernamePasswordProvider maybe this is the reason for getting a 403 instead of a redirect. But I can not figure out why ;-(