If you do type="redirect" the client will be issued a 302 "temporary redirect" status that will eventually redirect the browser to the new url.
If you want the user to still see the old "from" url in the browser's address line, try adding these to your "security" filter:
<dispatcher>REQUEST</dispatcher>
<dispatcher>FORWARD</dispatcher>