NullPointerException occurs when a user succeed authentication without any application roles.
i suggest to change security.xml in order to better manage access denied :

1) replace exceptionTranslationFilter by this one :

    <bean id="exceptionTranslationFilter" class="org.acegisecurity.ui.ExceptionTranslationFilter">
    <property name="authenticationEntryPoint">
            <bean class="org.acegisecurity.ui.webapp.AuthenticationProcessingFilterEntryPoint">
                <property name="loginFormUrl" value="/login.jsp"/>
                <property name="forceHttps" value="false"/>
            </bean>
         </property>
  <property name="accessDeniedHandler">
   <bean class="org.acegisecurity.ui.AccessDeniedHandlerImpl">
    <property name="errorPage" value="/login.jsp?accessDenied=true"/>
   </bean>
  </property>
   </bean>


2) add this to login.jsp :

<c:if test="${param.accessdenied != null}">
    <li class="error" >
        <img src="${ctx}/images/iconWarning.gif" alt="<fmt:message key='icon.warning'/>" class="icon"/>
        <fmt:message key="errors.accessDenied"/>
        <%--${sessionScope.ACEGI_SECURITY_LAST_EXCEPTION.message}--%>
    </li>
 
</c:if>


3) add this in applicationresources.properties :

errors.accessDenied=Vous n'avez pas de droits suffisants pour accéder à cette application.