Untitled

SpringSecurity multiple namespaces and secured-annotations. Great confusion
<global-method-security secured-annotations="enabled" />

<http pattern="/rest/**" authentication-manager-ref="authenticationManager" entry-point-ref="restAuthenticationEntryPoint">
    <form-login login-page="/rest/login" login-processing-url="/rest/postlogin"
        authentication-success-handler-ref="restAuthenticationSuccessHandler"
        authentication-failure-handler-ref="restAuthenticationFailureHandler"
        username-parameter="username" password-parameter="password" />
    <logout logout-url="/rest/logout" invalidate-session="true" />
</http>

<http pattern="/**" authentication-manager-ref="authenticationManager">
    <form-login login-page="/login" login-processing-url="/postlogin"
        username-parameter="username" password-parameter="password" />
    <logout />
</http>

@Secured({"ROLE_USER"})
@RequestMapping(method = RequestMethod.GET, headers = { "Range" })
public @ResponseBody
HttpEntity<List<T>> list(@RequestHeader("Range") String range) {