title: HttpSecurity configuration - permit all still requires basic auhthentication
body: <p>I'm trying to add an unsecured controller endpoint <code>/foo/bar</code> to my application, but whenever I try calling it, I get <code>401 Unauthorized</code>.</p>
  
  <p>Here's my <code>WebSecurityConfigurerAdapter</code>: </p>
  
  <pre><code>http
      .authorizeRequests()
          .antMatchers("/foo/**").permitAll()
      .and()
      .formLogin()
          .loginPage("/login").permitAll()
      .and()
      .requestMatchers()
          .antMatchers("/login", "/oauth/authorize", "/oauth/confirm_access")
      .and()
      .authorizeRequests()
          .anyRequest().authenticated();
  </code></pre>
  
  <p>Would somone kindly point out what am I missing?</p>