title: @RolesAllowed doesn't work
body: <p>I searched for the answer, but didn't find it. If I add <code>&lt;intercept-url pattern="/test*" access="ROLE_USER" /&gt;</code> inside the <code>&lt;form-login&gt;</code> of my spring-security.xml, everything works predictably. But if I want <code>@RolesAllowed("ROLE_ADMIN")</code> to act for the method:</p>
  
  <pre><code>@RolesAllowed("ROLE_ADMIN")
  @RequestMapping(value="/test", method = RequestMethod.GET)
  public String test() {
      return "test";
  }        
  </code></pre>
  
  <p>And if spring-security.xml looks like this (jsr250-annotations are enabled):</p>
  
  <pre><code>&lt;http auto-config="true"&gt;
      &lt;form-login login-page="/login.html" 
                  default-target-url="/welcome.html"
                  authentication-failure-url="/loginfailed.html" /&gt;
      &lt;logout logout-success-url="/logout.html" /&gt;
  &lt;/http&gt;          
  
  &lt;authentication-manager&gt;
    &lt;authentication-provider&gt;
          &lt;user-service&gt;
                  &lt;user name="john" password="doe" authorities="ROLE_ADMIN" /&gt;
                  &lt;user name="jane" password="doe" authorities="ROLE_USER" /&gt;
          &lt;/user-service&gt;
    &lt;/authentication-provider&gt;
  &lt;/authentication-manager&gt;
  
  &lt;global-method-security   secured-annotations="enabled" jsr250-annotations="enabled" /&gt;
  </code></pre>
  
  <p>Well, in this case both John and Jane can access the test page. I think I missed something basic, the help would be appreciated.</p>