title: Spring security and Thymeleaf doesn't work
body: <p>I am using Spring 4 and Thymeleaf
  In my index.xhtml page i wrote:</p>
  
  <pre><code>  &lt;!DOCTYPE html&gt;
    &lt;html xmlns="http://www.w3.org/1999/xhtml"
          xmlns:th="http://www.thymeleaf.org"
          xmlns:layout="http://www.ultraq.net.nz/thymeleaf/layout"
          xmlns:sec="http://www.thymeleaf.org/extras/spring-security"
          layout:decorator="layouts/layout"&gt;
  
    &lt;head&gt;
        &lt;title&gt;Welcome&lt;/title&gt;
    &lt;/head&gt;
    &lt;body&gt;
  ....
    &lt;div sec:authorize="hasRole('ROLE_ADMIN')"&gt;
        You are authorized user! Hi, &lt;span sec:authentication="name"&gt;Username&lt;/span&gt;
    &lt;/div&gt;
    &lt;div sec:authorize="isAnonymous()"&gt;
         You are NOT authorized user!
    &lt;/div&gt;
  ...
  &lt;/body&gt;&lt;/html&gt;
  </code></pre>
  
  <p>As a result I see:</p>
  
  <blockquote>
    <p>You are authorized user! Hi, Username You are NOT authorized user!</p>
  </blockquote>
  
  <p>i.e. Spring Security doesn't work</p>
  
  <p>My build.gradle (some dependecies) are:</p>
  
  <pre><code>compile 'org.thymeleaf:thymeleaf-spring4:2.1.2.RELEASE'
  compile 'org.thymeleaf.extras:thymeleaf-extras-springsecurity3:2.1.1.RELEASE'
  compile 'nz.net.ultraq.thymeleaf:thymeleaf-layout-dialect:1.2.3'
  compile 'org.springframework.security:spring-security-core:3.2.0.RELEASE'
  compile 'org.springframework.security:spring-security-web:3.2.0.RELEASE'
  compile 'org.springframework.security:spring-security-config:3.2.0.RELEASE'
  compile 'org.springframework.security:spring-security-taglibs:3.2.0.RELEASE'
  </code></pre>
  
  <p>My spring-security.xml is:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans:beans xmlns="http://www.springframework.org/schema/security"
               xmlns:beans="http://www.springframework.org/schema/beans"
               xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
               xmlns:context="http://www.springframework.org/schema/context"
               xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd
          http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
          http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd"&gt;
  
      &lt;!-- Настройка хранилища безопасности --&gt;
      &lt;authentication-manager&gt;
          &lt;authentication-provider&gt;
              &lt;password-encoder ref="bCryptPasswordEncoder"&gt;
              &lt;/password-encoder&gt;
              &lt;jdbc-user-service id="jdbcUserService" data-source-ref="dataSource"
                                 users-by-username-query="select login, password, is_enabled from users where login = ?"
                                 authorities-by-username-query="select u.login, p.`name` 
                      from user_group_ref ug, permission_group_ref pg, users u, groups g, permissions p
                      where ug.user_id=u.id and ug.group_id=g.id and pg.group_id=g.id and pg.permission_id = p.id and u.login = ?"
                                 group-authorities-by-username-query="select g.id, g.`name`, p.`name` 
                      from user_group_ref ug, permission_group_ref pg, users u, groups g, permissions p
                      where ug.user_id=u.id and ug.group_id=g.id and pg.group_id=g.id and pg.permission_id = p.id and u.login = ?"
                      /&gt;
          &lt;/authentication-provider&gt;
      &lt;/authentication-manager&gt;
  
      &lt;http use-expressions="true"&gt;
          &lt;!-- URLs на которых сработает интерцептор безопасности (permitAll - разрешить вход всем (в т.ч. анонимным)--&gt;
          &lt;intercept-url pattern="/*" access='permitAll'/&gt;
  
          &lt;!-- Настройка входа пользователя --&gt;
          &lt;form-login login-page="/account/signin" authentication-failure-url="/account/login/fail"
                      username-parameter="login"
                      password-parameter="password"/&gt;
  
          &lt;!-- Настройка выхода пользователя --&gt;
          &lt;logout logout-url="/account/logout" /&gt;
  
          &lt;!-- Включает поддержку функции "Запомнить меня" --&gt;
          &lt;remember-me remember-me-parameter="remember_me" user-service-ref="jdbcUserService"/&gt;
      &lt;/http&gt;
  
      &lt;!-- Если указать этот файл в authentication-provider выше, то юзеры будут храниться в этом файле --&gt;
      &lt;!--    &lt;user-service id="userService"&gt; --&gt;
      &lt;!--        &lt;user name="alexssource" authorities="ROLE_USER" password="123" /&gt; --&gt;
      &lt;!--    &lt;/user-service&gt; --&gt;
  
      &lt;!-- Хеширование паролей --&gt;
      &lt;!-- 
          При создании юзера используется так:
          -&gt; PasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
          -&gt; String encodedPassword = passwordEncoder.encode(password);
       --&gt;
      &lt;beans:bean id='bCryptPasswordEncoder' class='org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder'/&gt;
  &lt;/beans:beans&gt;
  </code></pre>
  
  <p>Before, I used the Apache Tiles and for it all works well.
  I don't understand why Spring Secury don't work with Thymeleaf.
  Please, help!</p>