title: Spring Security intercept url appears to be skipped/ignored
body: <p>I would like to have spring security configured so that one specific resource is locked down to a group, the rest are available to any logged in user. My security.xml looks like this</p>
  
  <pre><code>&lt;http auto-config="true" create-session="stateless" use-expressions="true"&gt;
      &lt;intercept-url pattern="/server/**" access="hasRole('ROLE_DEV-USER')" method="POST" requires-channel="https"/&gt;
  
      &lt;intercept-url pattern="/**" access="isFullyAuthenticated()" method="POST" requires-channel="https"/&gt;
      &lt;intercept-url pattern="/**" access="isFullyAuthenticated()" method="PUT" requires-channel="https"/&gt;
      &lt;intercept-url pattern="/**" access="isFullyAuthenticated()" method="DELETE" requires-channel="https"/&gt;
  
      &lt;intercept-url pattern="/**" access="permitAll" method="GET" requires-channel="any"/&gt;
      &lt;intercept-url pattern="/**" access="permitAll" method="HEAD" requires-channel="any"/&gt;
      &lt;http-basic /&gt;
      &lt;logout /&gt;
  &lt;/http&gt;
  
  &lt;authentication-manager&gt;
      &lt;authentication-provider&gt;
          &lt;user-service&gt;
              &lt;user name="admin" password="admin" authorities="ROLE_NOT-DEV-USER" /&gt;
              &lt;user name="admin2" password="admin2" authorities="ROLE_DEV-USER" /&gt;
          &lt;/user-service&gt;
      &lt;/authentication-provider&gt;
  &lt;/authentication-manager&gt;
  </code></pre>
  
  <p>I would expect the only admin to be able to POST to server/enable and server/disable. What I am actually seeing is both admin and admin2 can POST to the server/enable resource. As though the /server/** is ignored and the next more generic intercept-url is taking its place. The start up logs show all lines being loaded</p>
  
  <pre><code>2013-08-21 15:07:42,124  INFO FilterInvocationSecurityMetadataSourceParser:134 - Creating access control expression attribute 'hasRole('ROLE_DEV-USER')' for /server/**
  2013-08-21 15:07:42,125  INFO FilterInvocationSecurityMetadataSourceParser:134 - Creating access control expression attribute 'isFullyAuthenticated()' for /**
  2013-08-21 15:07:42,125  INFO FilterInvocationSecurityMetadataSourceParser:134 - Creating access control expression attribute 'isFullyAuthenticated()' for /**
  2013-08-21 15:07:42,126  INFO FilterInvocationSecurityMetadataSourceParser:134 - Creating access control expression attribute 'isFullyAuthenticated()' for /**
  2013-08-21 15:07:42,126  INFO FilterInvocationSecurityMetadataSourceParser:134 - Creating access control expression attribute 'permitAll' for /**
  2013-08-21 15:07:42,127  INFO FilterInvocationSecurityMetadataSourceParser:134 - Creating access control expression attribute 'permitAll' for /**
  </code></pre>
  
  <p>Currently using spring v3.1.2</p>