Spring Security provides out of the box a simple form login, logout and JDBC implementation of a users table. However, it does not provide a change password functionality which is needed to make a fully functional webapp with users.

Spring Security provides out of the box a simple form login, logout and JDBC implementation of a users table, but it does not provide:

toString() can be implemented on Java types to return a human-readable textual representation useful for debugging, but should it also be used to return a portable string suitable for serialization and persistence?