title: Using denyAll() and permitAll() together Spring security 3.0.8 not working
body: <p>We got a Web Application which is secured using Spring security 3.0.8. We use DWR for ajax, quite a lot. Now we want to deny access to all DWR calls unless specified explicitly:</p>
  
  <p>This is what I did, but doesn't work:</p>
  
  <pre><code>&lt;!-- Deny every url which is dwr call --&gt;
  &lt;intercept-url pattern="/js/dwr/**/**DWR**" access="denyAll"/&gt;
  
  &lt;!-- give access to SomeDWRClass for ROLE_A --&gt;
  &lt;intercept-url pattern="/js/dwr/**/SomeDWRClass**" access="hasAnyRole('ROLE_A')"/&gt;
  
  &lt;!-- Give access to everybody for CommonDwr.aCommonMethod.dwr --&gt;
  &lt;intercept-url pattern="/js/dwr/CommonDwr.aCommonMethod.dwr" access="permitAll"/&gt;
  </code></pre>
  
  <p>The problem is whenever there is a call to <strong>CommonDwr.aCommonMethod.dwr</strong> its showing <strong>access denied.</strong> Why? Is it because <strong>denyAll</strong> has got more precedence over <strong>permitAll?</strong>. </p>
  
  <p>If so or not, how do I solve this issue? I am sure there are lot of people out there who have had to secure their application like this. </p>
  
  <p>The main reason why we are doing this is if some new person comes and write a new DWR class, by default the permission should be denied, so that they can explicitly set an access role for the new class.</p>