Fairly new to Spring, so this may be basic.
We've recently transitioned from Spring 3 to 4 and running into some header issues with the new [defaults](https://docs.spring.io/spring-security/site/docs/current/reference/html/headers.html#default-security-headers) tied to one of our partners business logic

We would like to keep the defaults everywhere except for a specific URL "/stg/strategem/strg/drammin.syg"

Currently we have:

```
<http use-expressions="true" entry-point-ref="web.AuthenticaionEntryPoint">
   <intercept-url pattern="/admin/**" access = "hasAnyRole('GKR_ADMIN', 'GKR_ADMIN_ADV')"/>
   <intercept-url pattern="/**" access = "hasAnyRole('GKR_USER')"/>
</http>

```

How can I configure this so that ["/stg/strategem/strg/drammin.syg"] is still secured but is the only place where the below header configuration applies?

```
<headers defaults-disabled="true">
    <content-type-options />
    <hsts include-subdomains="true" max-age-seconds="31536000"/>
    <frame-options policy="SAMEORIGIN"/>
    <xss-protection block="false"/>
</headers>

```

UPDATE 1: Was able to make the URL I need headerless more specific

UPDATE 2:
I just tried adding another http block, but I keep getting the Spring Error

> 
> A universal match pattern ('/\*\*')
>  is defined before other patterns in the filter chain, causing them to be ignored.
> 
> 
> 

Regardless of what order I put these blocks in, I've even tried removing the "/\*\*" pattern, this error still comes up. 

My attempt:

```
<http use-expressions="true" entry-point-ref="web.AuthenticaionEntryPoint">
   <intercept-url pattern="/admin/**" access = "hasAnyRole('GKR_ADMIN', 'GKR_ADMIN_ADV')"/>
   <intercept-url pattern="/**" access = "hasAnyRole('GKR_USER')"/>
</http>

<http use-expressions="true" entry-point-ref="web.AuthenticaionEntryPoint">       
    <headers defaults-disabled="true">
        <content-type-options />
        <hsts include-subdomains="true" max-age-seconds="31536000"/>
        <frame-options policy="SAMEORIGIN"/>
        <xss-protection block="false"/>
    </headers>

    <intercept-url pattern="/stg/strategem/strg/drammin.syg" access = "hasAnyRole('GKR_ADMIN', 'GKR_ADMIN_ADV', 'GKR_USER')"/>
</http>

```

UPDATE 3: Was able to find a solution, check it out in the Answers