title: Spring security 3.1 Custom filter issue. Problems with anonymous urls exclusion
body: <p>I'm developing a RESTful api. There are two types of security restrictions on my urls:</p>
  
  <ul>
  <li>/rest/autenticate (anonymous in order to generate a token and receive the cookie)</li>
  <li>/rest/** (handled by AuthenticationTokenProcessingFilter which get the cookie and check it out)</li>
  </ul>
  
  <p>The main idea is to access to /authenticate anonymously in order to get the cookie and access to the other /rest/users /rest/.. with that cookie and check its validity on the custom filter.</p>
  
  <p>This is my http config:</p>
  
  <pre><code>&lt;http realm="Protected REST API" pattern="/rest/**" use-expressions="true" auto-config="false" create-session="stateless"  entry-point-ref="RestAuthenticationEntryPoint"&gt;
      &lt;custom-filter ref="AuthenticationTokenProcessingFilter" position="FORM_LOGIN_FILTER" /&gt;
      &lt;intercept-url pattern="/rest/authenticate*" access="IS_AUTHENTICATED_ANONYMOUSLY"/&gt;
      &lt;intercept-url pattern="/rest/**" access="isAuthenticated()"/&gt;
  &lt;/http&gt;
  </code></pre>
  
  <p>I also implemented some classes to do it works:</p>
  
  <pre><code>&lt;b:bean id="RestAuthenticationEntryPoint" class="**.web.security.RestAuthenticationEntryPoint" /&gt; 
  
  &lt;b:bean id="customAuthenticationManager" class="**.web.security.CustomAuthenticationManager"/&gt;
  
  &lt;b:bean id="AuthenticationTokenProcessingFilter" class="**.web.security.AuthenticationTokenProcessingFilter"&gt;
      &lt;b:constructor-arg type="**.web.security.CustomAuthenticationManager" ref="customAuthenticationManager"&gt;&lt;/b:constructor-arg&gt;
  &lt;/b:bean&gt;
  
  &lt;b:bean id="exceptionTranslationFilter" class="org.springframework.security.web.access.ExceptionTranslationFilter"&gt;
      &lt;b:property name="authenticationEntryPoint" ref="RestAuthenticationEntryPoint"/&gt;
      &lt;b:property name="accessDeniedHandler" ref="accessDeniedHandler"/&gt;
  &lt;/b:bean&gt;
  
  &lt;b:bean id="accessDeniedHandler" class="**.web.security.RestAccessDeniedHandler"&gt;
      &lt;b:property name="accessDeniedUrl" value="403" /&gt;
  &lt;/b:bean&gt;
  </code></pre>
  
  <p>Instead of going to the controller direcly, the doFilter of AuthenticationTokenProcessingFilter method intercepts /rest/authenticate.</p>
  
  <p>This is my AuthenticationTokenProcessingFilter:</p>
  
  <pre><code>public class AuthenticationTokenProcessingFilter extends GenericFilterBean {
  
      @Autowired 
      UserService userService;
  
      @Autowired 
      TokenUtilsService tokenUtilsService;
  
      CustomAuthenticationManager customAuthenticationManager;
  
      public AuthenticationTokenProcessingFilter(CustomAuthenticationManager customAuthenticationManager) {
          this.customAuthenticationManager = customAuthenticationManager;
      }
  
      @Override
      public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
          //Check the cookie calling to customAuthenticationManager.authenticate
          chain.doFilter(request, response);
      }
  }
  </code></pre>
  
  <p>I thought that this filter is only launched when a url is restricted. Maybe is always launched and I have to check if the role is anonymous manually?</p>
  
  <p>The solution will be voted and checked.</p>