title: sec:authorize returning true for both isAuthenticated() and isAnonymous() in thymeleaf view
body: <p>In my current spring-boot project, I have in my view a snippet of code like this in my thymeleaf view:</p>
  
  <pre><code>&lt;div class="account"&gt;
      &lt;ul&gt;
          &lt;li id="your-account" sec:authorize="isAnonymous()"&gt;
              ... code 1 ...
          &lt;/li&gt;
          &lt;li id="your-account" sec:authorize="isAuthenticated()"&gt;
              ... code 2 ...
          &lt;/li&gt;
          &lt;li th:if="${cart}"&gt;
              ...
          &lt;/li&gt;
      &lt;/ul&gt;
  &lt;/div&gt;
  </code></pre>
  
  <p>where only one of the snippets 1 or 2 should be displayed in the same time. But right now, when I open this view in the browser, the two areas are being displayed.</p>
  
  <p>Anyone can see what's wrong here?</p>
  
  <p>ps.: my thymeleaf configuration class is this:</p>
  
  <pre><code>@Configuration
  public class Thymeleaf {
  
    @Bean
    public SpringTemplateEngine templateEngine() {
      SpringTemplateEngine engine  =  new SpringTemplateEngine();
  
      final Set&lt;IDialect&gt; dialects = new HashSet&lt;IDialect&gt;();
      dialects.add( new SpringSecurityDialect() );
      engine.setDialects( dialects );
  
      return engine;
    }
  
  }
  </code></pre>
  
  <p>ps.: my spring-security configuration class is that:</p>
  
  <pre><code>@Configuration
  @ComponentScan(value="com.spring.loja")
  @EnableGlobalMethodSecurity(prePostEnabled=true)
  @EnableWebSecurity
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
          @Autowired
          private UserDetailsService userDetailsService;
  
          @Autowired
          private SocialUserDetailsService socialUserDetailsService;
  
          @Autowired
          private PasswordEncoder passwordEncoder;
  
          @Autowired
        private AuthenticationManagerBuilder auth;
  
          @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
              .csrf()
                  .disable()
              .authorizeRequests()
                  .antMatchers("/b3/**", "/v1.1/**", "/**", "/destaque/**", "/categoria/**").permitAll()
                  .anyRequest().authenticated()
                      .and()
                  .formLogin()
                      .loginPage("/signin")
                      .loginProcessingUrl("/login").permitAll()
                      .usernameParameter("login")
                      .passwordParameter("senha")
                      .and()
                  .logout()
                      .logoutUrl("/logout")
                      .logoutSuccessUrl("/")
                      .and()
                  .apply(new SpringSocialConfigurer());
      }
  
          @Override
          public void configure(WebSecurity web) throws Exception {
              DefaultWebSecurityExpressionHandler handler = new DefaultWebSecurityExpressionHandler();
          handler.setPermissionEvaluator(new CustomPermissionEvaluator());
          web.expressionHandler(handler);
      }
  
          @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth
              .userDetailsService(userDetailsService)
              .passwordEncoder(passwordEncoder);
      }
  
          @Bean
          @Override
          public AuthenticationManager authenticationManagerBean() throws Exception {
              return auth.getOrBuild();
          }
  }
  </code></pre>