Adding ContextLoaderListener to web.xml in Spring MVC

Only if you have two config xml files. One with Services / DAOs and another with Controller. If you have configured everything in one spring config file you don't need the ContextLoaderListener, just the dispatcher servlet is sufficient.

It is recommended to split the config into two and use the ContextLoaderListener to create the root application context and the dispatcher servlet to create the web layer application context.

Yes you need to add ContextLoaderListener in web.xml, only if you want to load other Spring context xml files as well while loading the app and you can specify them as

<context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>
        /WEB-INF/spring-security.xml
    </param-value>
</context-param>

It is optional, you don't really need it just for Spring MVC (DispatcherServlet will do). But adding Spring security to your Spring MVC must be done with

<listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>

Just one remark, if using ContextLoaderListener you will have to add DelegatingFilterProxy:

<listener>
    <listener-class>
        org.springframework.web.context.ContextLoaderListener
    </listener-class>
</listener>

<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/admin</url-pattern>
</filter-mapping>

<context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>     
    /WEB-INF/spring-security.xml
    </param-value>
</context-param>

in your web.xml as well. Sorry for being four years too late. Cheers