title: Spring Security URL pattern configuration
body: <p>This one should be quite simple. But I've been stuck with it for a while.
  I'm trying to implement Spring Security in my web application.</p>
  
  <p>By default, all URL's should be publically accessible. Except for following:</p>
  
  <ul>
  <li>/nl/favorieten/</li>
  <li>/fr/favorites/</li>
  </ul>
  
  <p>I've tried several things, ending up with the following:</p>
  
  <pre><code>&lt;http auto-config="true" access-denied-page="/login"&gt;
      &lt;intercept-url pattern="/*/favori*" access="IS_AUTHENTICATED_FULLY" /&gt;
      &lt;intercept-url pattern="/**" access="IS_AUTHENTICATED_ANONYMOUSLY" /&gt;
      &lt;form-login
         always-use-default-target="true"
         login-page="/login"
         default-target-url="/"
         authentication-failure-url="/login?login_error=1" /&gt;
      &lt;logout invalidate-session="false" logout-url="/logout" /&gt;
  &lt;/http&gt;
  </code></pre>
  
  <p>obviously without success.
  I've tried just about any combination of regex, ordering the rules, changing roles. But nothing seems to redirect my request to /login.</p>
  
  <p>Except ofcourse if I say /** should be IS_AUTHENTICATED_FULLY</p>