title: When I call logout it changes the jsessionid, but still allows me to access other paths without having to log in
body: <p>I'm attempting to logout using Spring Security, but any time I call the logout url it changes the jsessionid, but I can still access urls that should be restricted and ask for me to log back in.</p>
  
  <pre><code>public void configure(HttpSecurity httpSecurity) throws Exception{
  
          httpSecurity.httpBasic();
  
          httpSecurity.authorizeRequests()
                  .mvcMatchers(HttpMethod.GET, "/privateEvent").hasAuthority("REGISTERED_USER")
                  .mvcMatchers(HttpMethod.DELETE, "/privateEvent/*").hasAuthority("RSVP_ADMIN")
                  .mvcMatchers("/registerPrivateEvent").hasAuthority("REGISTERED_USER")
                  .mvcMatchers("/guestList").hasAuthority("EVENT_PUBLISHER")
                  .mvcMatchers("/eventPublishersList").hasAuthority("RSVP_ADMIN")
                  .anyRequest().permitAll()
           .and()
                  .logout()
                  .invalidateHttpSession(true)
                  .deleteCookies("JSESSIONID")
                  .deleteCookies("XSRF-TOKEN")
                  .clearAuthentication(true)
                  .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
                  .logoutSuccessUrl("/allDone")
                  .permitAll()
            .and()
                  .csrf().disable();
  }
  </code></pre>