I have few views made in Vaadin by @Route and now I want to add Security and some Login. In my `SecurityConfiguration` class I'm setting `antMatchers.permitAll()` only for 2 views and for the rest with Role `ADMIN`. But it is not working as I think it should. It demands login to access every view, and after login I have access to all views no matter what role has the user. 

I hoped this tutorial will help me, but in there are no views accessible without login.

[Securing Your App With Spring Security](https://vaadin.com/tutorials/securing-your-app-with-spring-security)

My configuration class:
=======================

```
@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    private UserService userService;

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Autowired
    public SecurityConfiguration(UserService userService) {
        this.userService = userService;
    }

    @Autowired
    private void configureAuth(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userService);
        auth.inMemoryAuthentication()
                .withUser("user")
                .password(passwordEncoder().encode("user"))
                .roles("USER");
    }

  @Override
  protected void configure(HttpSecurity http) throws Exception {
      http.httpBasic().and()
              .anonymous()
              .and()
              .authorizeRequests()
              .antMatchers("/", "/login").permitAll()
              .antMatchers("/recipe-manager", "/ingredient-manager").hasAnyRole("ADMIN")
              .and()
              .formLogin().loginPage("/login").permitAll()
              .and()
              .logout().logoutSuccessUrl("/")
              .and()
              .csrf().disable().cors().disable().headers().disable();
  }
    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers(
                "/VAADIN/**",
                "/favicon.ico",
                "/robots.txt",
                "/manifest.webmanifest",
                "/sw.js",
                "/offline-page.html",
                "/icons/**",
                "/images/**",
                "/frontend/**",
                "/webjars/**",
                "/h2-console/**",
                "/frontend-es5/**", "/frontend-es6/**");
    }
}

```

My Views have annotations like:

```
@Route("recipe-manager")
public class RecipeManagerView extends VerticalLayout
@Route("")
public class RecipeBrowserView extends VerticalLayout 
@Route("login")
public class LoginView extends VerticalLayout 
@Route("ingredient-manager")
public class IngredientManagerView extends VerticalLayout 

```

I would expect that anyone can have access to `RecipeBrowserView` and `LoginView`, but only logged user can have access to `RecipeManagerView` and `IngredientMangerView`.