title: Pre/PostAuthorize annotations not working
body: <p>As it seems that Spring Security forum is not giving much support, I'm forced to ask the same question here as well. I'm building a web application using Spring 3.0.6 and Spring Security 3.0.7, but there's a problem that's driving me insane. Method protection annotations just don't work. I'm protecting the method on my service interface this way:</p>
  
  <pre><code>public interface AlbumGenreService {
  
       @PreAuthorize("hasRole('ROLE_ADMIN')")
       public void deleteGenre(Integer genreId);
  }
  </code></pre>
  
  <p>and then invoking the method in the controller:</p>
  
  <pre><code>@RequestMapping(value="/genres/delete/{genreId}")
  public String deleteGenre(@PathVariable("genreId") Integer genreId, Model model) {
  
       albumGenreService.deleteGenre(genreId);
  
       return "redirect:/genres/view";
  }
  </code></pre>
  
  <p>When I log in with ROLE_USER role and try to delete the genre, the access to the protected method is granted and the genre is deleted. </p>
  
  <p>My configuration is as follows:</p>
  
  <p>web.xml</p>
  
  <pre><code>&lt;servlet&gt;
     &lt;servlet-name&gt;dispatcher&lt;/servlet-name&gt;
     &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherSe rvlet&lt;/servlet-class&gt;
     &lt;init-param&gt;
       &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
       &lt;param-value&gt;/WEB-INF/applicationContext.xml&lt;/param-value&gt;
     &lt;/init-param&gt;
     &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
  &lt;/servlet&gt;
  
  &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;dispatcher&lt;/servlet-name&gt;
      &lt;url-pattern&gt;/&lt;/url-pattern&gt;
  &lt;/servlet-mapping&gt;
  
  &lt;filter&gt;
      &lt;filter-name&gt;sitemesh&lt;/filter-name&gt;
      &lt;filter-class&gt;com.opensymphony.module.sitemesh.filter.Page Filter&lt;/filter-class&gt;
  &lt;/filter&gt;
  
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;sitemesh&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  
  
  &lt;filter&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;filter-class&gt;org.springframework.web.filter.DelegatingFil terProxy&lt;/filter-class&gt;
  &lt;/filter&gt;
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  
  
  &lt;context-param&gt;
     &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
     &lt;param-value&gt;/WEB-INF/securityApplicationContext.xml&lt;/param-value&gt;
  &lt;/context-param&gt;
  
  &lt;listener&gt;
     &lt;listener-class&gt;org.springframework.web.context.ContextLoade rListener&lt;/listener- class&gt;
  &lt;/listener&gt; 
  </code></pre>
  
  <p>securityApplicationContext.xml</p>
  
  <pre><code>&lt;beans xmlns="http://www.springframework.org/schema/beans"
  xmlns:security="http://www.springframework.org/schema/security"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://www.springframework.org/schema/beans
  http://www.springframework.org/schem...-beans-3.0.xsd
  http://www.springframework.org/schema/security
  http://www.springframework.org/schema/security/spring-security-3.0.4.xsd"&gt;
  
  &lt;security:global-method-security pre-post-annotations="enabled" secured-  annotations="enabled" jsr250-annotations="enabled"/&gt;
  
  &lt;security:http auto-config="true" use-expressions="true"&gt;
     &lt;security:intercept-url pattern="/genres/create" access="hasRole('ROLE_ADMIN')"/&gt;
     &lt;security:intercept-url pattern="/*" access="hasAnyRole('ROLE_ADMIN','ROLE_USER')"/&gt;
  &lt;/security:http&gt;
  
  &lt;security:authentication-manager alias="authenticationManager"&gt;
    &lt;security:authentication-provider&gt;
       &lt;security:user-service&gt;
       &lt;security:user name="user1" password="user1" authorities="ROLE_USER"/&gt;
       &lt;security:user name="admin" password="admin" authorities="ROLE_ADMIN"/&gt;
  &lt;/security:user-service&gt;
  &lt;/security:authentication-provider&gt;
  &lt;/security:authentication-manager&gt;
  </code></pre>
  
  <p>Hope you could help me to figure out what's going wrong. Thanks.</p>