title: Authentication fails silently in Symfony2
body: <p>I'm having trouble getting authentication to work but it only appears to happen in very specific circumstances. Authentication is done via a third party API so I've written my own user provider class and inside that class is some code that syncs data between the API and Symfony, as part of that syncing process it determines which roles the user should have.
  After doing this it sets up the relationships between the roles and user via a ManyToMany relationship.</p>
  
  <p>The getRoles() method in my User object gets the role objects out of the database and turns it into an array of strings, the role names come from my database and all start with ROLE_.</p>
  
  <p>If I login with an account that should have no extra roles it works fine, but if I login to an account that should have roles I just get sent back to the login screen with no error message.</p>
  
  <p>I've checked the log and saw these entries:</p>
  
  <pre><code>security.INFO: User "test105@example.com" has been authenticated successfully [] []
  event.DEBUG: Notified event "security.interactive_login" to listener "Pogo\MyBundle\Listener\LoginListener::onSecurityInteractivelogin". [] []
  event.DEBUG: Listener "Symfony\Component\Security\Http\Firewall::onKernelRequest" stopped propagation of the event "kernel.request". [] []
  event.DEBUG: Listener "Symfony\Bundle\FrameworkBundle\EventListener\RouterListener" was not called for event "kernel.request". [] []
  event.DEBUG: Listener "Symfony\Bundle\AsseticBundle\EventListener\RequestListener" was not called for event "kernel.request". [] []
  event.DEBUG: Notified event "kernel.response" to listener "Symfony\Component\Security\Http\Firewall\ContextListener::onKernelResponse". [] []
  security.DEBUG: Write SecurityContext in the session [] []
  event.DEBUG: Notified event "kernel.response" to listener "Symfony\Component\HttpKernel\EventListener\ResponseListener::onKernelResponse". [] []
  event.DEBUG: Notified event "kernel.response" to listener "Symfony\Bundle\SecurityBundle\EventListener\ResponseListener::onKernelResponse". [] []
  event.DEBUG: Notified event "kernel.response" to listener "Symfony\Bridge\Monolog\Handler\FirePHPHandler::onKernelResponse". [] []
  event.DEBUG: Notified event "kernel.response" to listener "Sensio\Bundle\FrameworkExtraBundle\EventListener\CacheListener::onKernelResponse". [] []
  event.DEBUG: Notified event "kernel.response" to listener "Symfony\Component\HttpKernel\EventListener\ProfilerListener::onKernelResponse". [] []
  event.DEBUG: Notified event "kernel.response" to listener "Symfony\Bundle\WebProfilerBundle\EventListener\WebDebugToolbarListener::onKernelResponse". [] []
  event.DEBUG: Notified event "kernel.request" to listener "Symfony\Bundle\FrameworkBundle\EventListener\RouterListener::onEarlyKernelRequest". [] []
  event.DEBUG: Notified event "kernel.request" to listener "Symfony\Bundle\FrameworkBundle\EventListener\SessionListener::onKernelRequest". [] []
  event.DEBUG: Notified event "kernel.request" to listener "Symfony\Component\Security\Http\Firewall::onKernelRequest". [] []
  security.INFO: Populated SecurityContext with an anonymous Token [] []
  event.DEBUG: Notified event "kernel.exception" to listener "Symfony\Component\Security\Http\Firewall\ExceptionListener::onKernelException". [] []
  security.DEBUG: Access denied (user is not fully authenticated); redirecting to authentication entry point [] []
  security.DEBUG: Calling Authentication entry point [] []
  </code></pre>
  
  <p>I don't understand how it can be authenticated at top, then as soon as it checks the firewall it finds itself with an anonymous token which is why it presumably sends me back to the login screen.</p>
  
  <p>My firewall / access_control settings are:</p>
  
  <pre><code>firewalls:
      public:
          pattern: /.*
          anonymous: true
          tessitura_login:
              login_path: /account/login
              check_path: /secure/login_check
          logout:
              path: /secure/logout
              target: /
  access_control:
      - { path: ^/secure/.*, role: ROLE_USER }
      - { path: ^/admin.*, role: ROLE_ADMIN }
      - { path: ^/account/login/?, role: IS_AUTHENTICATED_ANONYMOUSLY }
      - { path: /.*, role: IS_AUTHENTICATED_ANONYMOUSLY }
  </code></pre>
  
  <p>Any help with this would be massively appreciated, I've spent a few hours on this now and am completely stumped.</p>