title: Failed to evaluate expression with spring security
body: <p>I have a Spring rest service, and I'm trying to add security to it. I followed <a href="http://www.baeldung.com/2011/10/31/securing-a-restful-web-service-with-spring-security-3-1-part-3/#config" rel="nofollow">this tutorial</a>, but when I try to access the service directly I get the following error:</p>
  
  <blockquote>
    <p>There was an unexpected error (type=Internal Server Error,
    status=500). Failed to evaluate expression 'ROLE_USER'</p>
  </blockquote>
  
  <p>Here's my security configuration:</p>
  
  <p><code>webSecurityConfig.xml</code></p>
  
  <pre><code>&lt;http entry-point-ref="restAuthenticationEntryPoint"&gt;
        &lt;intercept-url pattern="/**" access="ROLE_USER"/&gt;
  
        &lt;form-login
           authentication-success-handler-ref="mySuccessHandler"
           authentication-failure-handler-ref="myFailureHandler"
        /&gt;
  
        &lt;logout /&gt;
     &lt;/http&gt;
  
     &lt;beans:bean id="mySuccessHandler"
        class="com.eficid.cloud.security.rest.AuthenticationSuccessHandler"/&gt;
     &lt;beans:bean id="myFailureHandler" class=
       "org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler"/&gt;
  
  
        &lt;authentication-manager&gt;
          &lt;authentication-provider&gt;
            &lt;user-service&gt;
              &lt;user name="temp" password="temp" authorities="ROLE_USER" /&gt;
            &lt;/user-service&gt;
          &lt;/authentication-provider&gt;
        &lt;/authentication-manager&gt; 
  </code></pre>
  
  <p><code>SpringSecurityConfig</code>:</p>
  
  <pre><code>public class SpringSecurityConfig {
  
      public SpringSecurityConfig() {
          super();
      }
  
  }
  </code></pre>
  
  <p>I'm also getting this error when trying to use curl to log in:</p>
  
  <pre><code>{
  "timestamp":1460399841286,
  "status":403,"error":"Forbidden",
  "message":"Could not verify the provided CSRF token because your session was not found.",
  "path":"/spring-security-rest/login"
  }
  </code></pre>
  
  <p>Do I need to add the csrf token manually to the command? The service has a self-signed certificate, if that makes any difference.</p>