I am attempting to setup basic [HTTP browser-based authentication](http://websecurity.com.ua/uploads/2011/03/Attack%20on%20Firefox.png) for a section of my Symfony 2 application called `/secret`. 

I would like the `/secret` page to be publicly accessible, but any page below `/secret` such as `/secret/landing` would be behind a SF2 firewall.

When I go to `/secret` (or of its any child page) I get redirected to my application's `/login` page instead and I can't see why?

```
security:
    providers:
        sylius_user_provider:
            id: sylius.user_provider.name_or_email
        in_memory:
            memory:
                users:
                    secret:
                        password: secret
                        roles: 'ROLE_SECRET'

    encoders:
        Symfony\Component\Security\Core\User\User: plaintext

    firewalls:
        main:
            switch_user: { role: ROLE_ADMINISTRATION_ACCESS }
            context:     user
            pattern:     /.*
            form_login:
                provider: sylius_user_provider
                login_path: /login
                check_path: /login_check
                failure_path: /login
                default_target_path: /
                use_forward:  false
                use_referer: true
            remember_me:
                key: %sylius.secret%
                name: APP_REMEMBER_ME
                lifetime: 31536000
                always_remember_me: true
                remember_me_parameter: _remember_me
            oauth:
                resource_owners:
                    facebook: "/login/check-facebook"
                    google:   "/login/check-google"
                    amazon:   "/login/check-amazon"
                login_path:   /login
                failure_path: /login
                oauth_user_provider:
                    service: sylius.oauth.user_provider
            logout: true
            anonymous: true

        secret:
            pattern: ^/secret/.*
            http_basic: ~
            provider: in_memory
            context: secret

    access_control:
        - { path: ^/secret/.*, roles: ROLE_SECRET }

```