title: PreAuthorize not working on Controller
body: <p>I'm trying to define access rules at method-level but it's not working what so ever.</p>
  
  <p>SecurityConfiguration</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @EnableGlobalMethodSecurity(prePostEnabled = true)
  public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
      @Override
      public void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth.inMemoryAuthentication().
                  withUser("user").password("user").roles("USER").and().
                  withUser("admin").password("admin").roles("ADMIN");
      }
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
                  .sessionManagement()
                  .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                  .and()
                  .authorizeRequests()
                  .antMatchers("/v2/**").authenticated()
                  .and()
                  .httpBasic()
                  .realmName("Secure api")
                  .and()
                  .csrf()
                  .disable();
      }
  }
  </code></pre>
  
  <p>ExampleController</p>
  
  <pre><code>@EnableAutoConfiguration
  @RestController
  @RequestMapping({"/v2/"})
  public class ExampleController {
      @PreAuthorize("hasAuthority('ROLE_ADMIN')")
      @RequestMapping(value = "/home", method = RequestMethod.GET)
      String home() {
          return "Hello World";
      }
  }
  </code></pre>
  
  <p>Whenever I try to access /v2/home using <code>user:user</code> it executes just fine, shouldn't it give me an Access Denied error due to 'user' not having <code>ROLE_ADMIN</code>?</p>
  
  <p>I'm actually thinking of ditching access rules at method-level and stick to http() ant rules, but I have to know why it's not working for me.</p>