title: sec:authorize and sec:authentication annotations don't work
body: <p>I have a Spring + Thymeleaf project with the following view code.</p>
  
  <pre><code>&lt;!DOCTYPE html SYSTEM "http://www.thymeleaf.org/dtd/xhtml1-strict-thymeleaf-spring3-3.dtd"&gt;
  &lt;html
          xmlns="http://www.w3.org/1999/xhtml"
          xmlns:th="http://www.thymeleaf.org"
          xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity3"&gt;
  
  &lt;head&gt;
      &lt;title&gt;Contacts&lt;/title&gt;
      &lt;meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/&gt;
  &lt;/head&gt;
  &lt;body&gt;
  &lt;div id="content"&gt;
      &lt;h1&gt;Welcome to the site!&lt;/h1&gt;
      &lt;p th:if="${loginError}"&gt;Wrong user or password&lt;/p&gt;
      &lt;form th:action="@{/j_spring_security_check}" method="post"&gt;
          &lt;label for="j_username"&gt;Email address&lt;/label&gt;:
          &lt;input type="text" id="j_username" name="j_username"/&gt; &lt;br/&gt;
          &lt;label for="j_password"&gt;Password&lt;/label&gt;:
          &lt;input type="password" id="j_password" name="j_password"/&gt; &lt;br/&gt;
          &lt;input type="submit" value="Log in"/&gt;
      &lt;/form&gt;
  &lt;/div&gt;
  
  &lt;div sec:authorize="isAuthenticated()"&gt;
      User: &lt;span sec:authentication="name"&gt;miquel&lt;/span&gt;
  &lt;/div&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>The sec:authorize and sec:authentication attributes don't work as expected - the div is always shown, even if no user is logged in, and the span always reads "miquel". </p>
  
  <p>Follows a relevant snippet from my controller class. </p>
  
  <pre><code>@RequestMapping(value = "/welcome.html") 
  public String wellcome() { 
      Authentication auth = SecurityContextHolder.getContext().getAuthentication(); 
      System.out.println("username: " + auth.getName()); 
  
      return "home"; 
  }
  </code></pre>
  
  <p>The println statement works as expected - if no user is logged in, it prints "anonymousUser", otherwise the username. </p>
  
  <p>What am I doing wrong?</p>