Can't get why Spring security 4 isn't working

I'm learning spring with John from caveofprogramming (spring 3x version udemy course) I have Tomcat 8x and 4.1.6 core and 4.0.0 security jars.

All works except security. My web.xml file is

    <?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://ift.tt/nSRXKP"
           xmlns:xsi="http://ift.tt/ra1lAU"
           xsi:schemaLocation="http://ift.tt/nSRXKP
          http://ift.tt/1eWqHMP"
           version="3.0">

    <description>MySQL Test App</description>

    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>
            classpath:spring-security-config.xml
            classpath:dao-context.xml
            classpath:service-context.xml
        </param-value>
    </context-param>

    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>

    <servlet>
        <servlet-name>offers</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <load-on-startup>1</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>offers</servlet-name>
        <url-pattern>/</url-pattern>
    </servlet-mapping>

    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>

    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>


    <resource-ref>
        <description>DB Connection</description>
        <res-ref-name>jdbc/spring</res-ref-name>
        <res-type>javax.sql.DataSource</res-type>
        <res-auth>Container</res-auth>
    </resource-ref>

</web-app>

My security xml file is

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://ift.tt/GArMu6"
       xmlns:xsi="http://ift.tt/ra1lAU"
       xmlns:security="http://ift.tt/1c8inpe"
       xsi:schemaLocation="http://ift.tt/1c8inpe http://ift.tt/18sW2ay
        http://ift.tt/GArMu6 http://ift.tt/1jdM0fG">
    <security:authentication-manager>
        <security:authentication-provider>
            <security:user-service>
                <security:user name="John" authorities="admin"
                               password="letmein" />
                <security:user name="Zog" authorities="admin"
                               password="iamzog" />
            </security:user-service>
        </security:authentication-provider>
    </security:authentication-manager>
    <security:http>
        <security:intercept-url pattern="/**" access="denyAll"/>
        <security:form-login/>
    </security:http>
</beans>

In fact my web-application must not allow anybody to enter, but it looks like spring security isn't working - pages are in free access.

I tried to download code from udemy for security lecture and build it. Spring 3x version is works fine, but when I change version to 4x - security magic disappears.

I read some info about migration from docs.spring.io but can't find anything about this situation. Any ideas, please?