title: Spring Security <http> and <intercept-url> pattern attributes
body: <p>I have seen Spring Security OAuth2 samples has this defined in the <code>spring-servlet.xml</code>,</p>
  
  <pre><code>   &lt;http pattern="/users/**" create-session="never" entry-point-ref="oauthAuthenticationEntryPoint"
        access-decision-manager-ref="accessDecisionManager" xmlns="http://www.springframework.org/schema/security"&gt;
      &lt;anonymous enabled="false" /&gt;
      &lt;intercept-url pattern="/photos" access="ROLE_USER,SCOPE_READ" /&gt;
      &lt;intercept-url pattern="/photos/trusted/**" access="ROLE_CLIENT,SCOPE_TRUST" /&gt;
      &lt;intercept-url pattern="/photos/user/**" access="ROLE_USER,SCOPE_TRUST" /&gt;
      &lt;intercept-url pattern="/photos/**" access="ROLE_USER,SCOPE_READ" /&gt;
      &lt;custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" /&gt;
      &lt;access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
  &lt;/http&gt;
  </code></pre>
  
  <p>Is the <code>pattern</code> attribute in <code>http</code> tag valid? I could not find its definition in the <code>spring-security-2.0.1.xsd</code>. If it is valid, what is the relationship of this pattern with <code>intercept-url</code>'s <code>pattern</code> attribute? Take for example, does the intercept path <code>/photos/user/**</code> has the final matching interception path of <code>/users/photos/user/**</code>? Thanks.</p>