title: JHipster with @PreAuthorize always allow access
body: <p>My Resource has this code:</p>
  
  <pre><code>    @DeleteMapping("/devices/{id}")
      @Timed
      @PreAuthorize("hasAuthority('ROLE_ADMIN')")
      public ResponseEntity&lt;Void&gt; deleteDevice(@PathVariable Long id) {
          log.debug("REST request to delete Device : {}", id);
          deviceService.delete(id);
          return ResponseEntity.noContent().headers(HeaderUtil.createEntityDeletionAlert(applicationName, true, ENTITY_NAME, id.toString())).build();
      }
  </code></pre>
  
  <p>It is supposed to be executed only by users with 'ROLE_ADMIN'. However, any logged user can run it, even if they don't possess the ROLE_ADMIN authority.</p>
  
  <p>I've also tried by adding</p>
  
  <pre><code>            .antMatchers(HttpMethod.DELETE,"/api/**").hasAuthority(AuthoritiesConstants.ADMIN)
  </code></pre>
  
  <p>on the SecurityConfiguration, but requests are never blocked. What am I missing? I'm using JHipster 6.9.1</p>