title: Trying to switch the security off for one URL with XML configuration
body: <p>I checked several blogs / doc / stackoverflow forum entries but I still don't know what I am doing wrong.<br>
  I want to give access to an URL to anybody. The <strong><code>permitAll</code></strong> doesn't work as I have custom filters. So I thought to create a separate <strong><code>http</code></strong> element and use the <strong><code>security="none"</code></strong> setting but no success so far.</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;security:http pattern="/status" security="none"/&gt;
  
  &lt;!-- ******************** rules with encryption and HMAC authentication ******************** --&gt;
  &lt;security:http create-session="stateless" use-expressions="true" authentication-manager-ref="authenticationManager" auto-config="true" entry-point-ref="http403EntryPoint" pattern="/**"&gt;
      &lt;!-- HMAC only --&gt;
      &lt;security:intercept-url pattern="/utils/logheaderpattern/check" access="authenticated" /&gt;
      &lt;security:intercept-url pattern="/executionflow/approve" access="authenticated" /&gt;
      &lt;security:intercept-url pattern="/executionflow/approve_and_forced_start" access="authenticated" /&gt;
      &lt;security:intercept-url pattern="/utils/maintenancewindow/next/**" access="authenticated" /&gt;
      &lt;security:intercept-url pattern="/executionflow/start/manual" access="authenticated" /&gt;
      &lt;security:intercept-url pattern="/executionflow/start/eventlife" access="authenticated" /&gt;
      &lt;security:intercept-url pattern="/executionflow/skip/eventlife" access="authenticated" /&gt;
      &lt;security:intercept-url pattern="/executionflow/start/scheduled" access="authenticated" /&gt;
      &lt;security:intercept-url pattern="/utils/cron/nextrun" access="authenticated" /&gt;
      &lt;!-- HMAC and encryption (set in encryptionFilter) --&gt;
      &lt;security:intercept-url pattern="/worker/command/**" access="authenticated" /&gt;
      &lt;security:intercept-url pattern="/worker/event" access="authenticated" /&gt;
      &lt;security:intercept-url pattern="/worker/system/**" access="authenticated" /&gt;
      &lt;!-- deny all others --&gt;
      &lt;security:intercept-url pattern="/**" access="denyAll" /&gt;
  
      &lt;security:csrf disabled="true" /&gt;
      &lt;security:custom-filter ref="encryptionFilter" before="FORM_LOGIN_FILTER"/&gt;
      &lt;security:custom-filter ref="hmacAuthenticationFilter" after="FORM_LOGIN_FILTER"/&gt;
  &lt;/security:http&gt;
  
  
  &lt;!-- ******************** Defining the authentication manager ******************** --&gt;
  &lt;security:authentication-manager erase-credentials="false" id="authenticationManager"&gt;
      &lt;security:authentication-provider user-service-ref="fileBasedUserDetailsService"&gt;
      &lt;/security:authentication-provider&gt;
  &lt;/security:authentication-manager&gt;
  </code></pre>
  
  <p>And the controller:</p>
  
  <pre class="lang-java prettyprint-override"><code>@Controller
  public class WebController {
    @RequestMapping(value = "/status", method = RequestMethod.GET)
    public String redirect() {
       return "redirect:/pages/status.html";
    }
  }
  </code></pre>
  
  <p>And the Spring Boot initializer</p>
  
  <pre class="lang-java prettyprint-override"><code>@Configuration
  @ImportResource({"classpath:applicationContext.xml", "classpath:securityContext.xml"})
  @ComponentScan(basePackages = {"org.reaction.engine.controller", 
                              "org.reaction.engine.persistence.service",
                              "org.reaction.engine.persistence.converter",
                              "org.reaction.engine.service",
                              "org.reaction.engine.scheduling.utils"})
  @EnableAutoConfiguration
  public class WebInitializer extends SpringBootServletInitializer implements WebApplicationInitializer {
  
    @Override
    protected SpringApplicationBuilder configure(SpringApplicationBuilder application) {
       return application.sources(WebInitializer.class);
    }
  
  
    public static void main(String[] args) throws Exception {
       SpringApplication.run(WebInitializer.class, args);
    }
  
  }
  </code></pre>
  
  <p>I keep getting the </p>
  
  <pre><code>  2018-01-15 16:04:02.676 ERROR [org.springframework.boot.web.support.ErrorPageFilter:176] - Forwarding to error page from request [/status] due to exception [An Authentication object was not found in the SecurityContext]
    org.springframework.security.authentication.AuthenticationCredentialsNotFoundException: An Authentication object was not found in the SecurityContext
            at org.springframework.security.access.intercept.AbstractSecurityInterceptor.credentialsNotFound(AbstractSecurityInterceptor.java:379)
            at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:223)
            at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:124)
            at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:91)
  </code></pre>
  
  <p>exception. Any idea?</p>