title: Spring Security: method is not secured with @PreAuthorize annotation
body: <p>I would like to secure method in my managed session bean for specific role <code>"ROLE_ADMIN"</code></p>
  
  <p>config(applicationContext-security.xml):</p>
  
  <pre><code>&lt;global-method-security pre-post-annotations="enabled" jsr250-annotations="enabled" secured-annotations="enabled"/&gt;
      &lt;http auto-config="true" use-expressions="true"&gt;
          &lt;intercept-url pattern="/**" access="isAuthenticated()"/&gt;
          &lt;intercept-url pattern="/**" access="permitAll()"/&gt;
          &lt;form-login
           login-processing-url="/j_spring_security_check"
           login-page="/login.jsf"
           default-target-url="/main.jsf"
           authentication-failure-url="/login.jsf" /&gt;
  
      &lt;session-management&gt;
             &lt;concurrency-control max-sessions="1" error-if-maximum-exceeded="false" /&gt;
      &lt;/session-management&gt;
      &lt;/http&gt;
  
  
      &lt;authentication-manager alias="authenticationManager"&gt;
          &lt;authentication-provider&gt;
              &lt;user-service&gt;
                  &lt;user name="admin" password="admin" authorities="ROLE_USER, ROLE_ADMIN" /&gt;
                  &lt;user name="user1" password="user1" authorities="ROLE_USER" /&gt;
              &lt;/user-service&gt;
          &lt;/authentication-provider&gt;
      &lt;/authentication-manager&gt;
  
      &lt;beans:bean id="loggerListener" class="org.springframework.security.authentication.event.LoggerListener"/&gt;
  </code></pre>
  
  <p>bean's secured method:</p>
  
  <pre><code>    @PreAuthorize("hasRole('ROLE_ADMIN')")
      public String buy() {
  ...
      }
  </code></pre>
  
  <p>When I logged in under <code>user1</code> or as <code>anonym</code> and click "buy" button on web-page, it still redirected to the next page.</p>
  
  <p>I expect that some access denied exception occurred, and it doesn't.</p>