BindingResult holds the errors; Thymeleaf shows them with th:errors.