title: Unauthorized request eventhough permitted
body: <p>I have the following websecurityconfig and want to allow anyone to access login page but when I try to login, it throws unauthorized exception. When I try to send /user/create request, it works very well and does its job. </p>
  
  <pre><code>http.httpBasic().disable()
              .csrf().disable()
              .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
              .and()
              .authorizeRequests()
              .antMatchers("/actuator/**").hasAuthority(Role.ADMIN.toString())
              .antMatchers("/").permitAll()
              .antMatchers(HttpMethod.DELETE,"/user/remove").hasAnyAuthority(Role.ADMIN.toString(), Role.USER.toString())
              .antMatchers(HttpMethod.PUT, "/user/create").permitAll()
              .antMatchers(HttpMethod.POST, "**/login", "login", "/login").permitAll() // trying combinations of login path
              .antMatchers("/admin/**").hasAuthority(Role.ADMIN.toString())
              .and()
              .apply(new JwtConfig(jwtTokenProvider));
  </code></pre>
  
  <p>Here is login controller. I put debugger in the return line and execution does not event come to that point. Security throws the exception.</p>
  
  <pre><code>@RestController
  @RequestMapping // I also tried @RequestMapping({"","/"})
  public class PublicController {
  
  @Autowired
  AuthenticationService authenticationService;
  
  @PostMapping(value = "login", consumes = "application/json")
  public GenericResponse login(@RequestBody UserLoginDTO userLoginDTO) {
      return authenticationService.login(userLoginDTO); // never reached this line
  }
  }
  </code></pre>
  
  <p>How can I handle this?</p>