title: Spring Boot Security not ignoring certian url via WebSecurity
body: <p>I am using Spring boot 1.3.2 with Spring Security.
  I have following configure(HttpSecurity http) method to inforce authentication</p>
  
  <pre><code>    protected void configure(HttpSecurity http) throws Exception {
  
      RequestMatcher csrfRequestMatcher = new RequestMatcher() {
            private AntPathRequestMatcher[] requestMatchers = {
                new AntPathRequestMatcher("/iams/w/*")
            };
            @Override
            public boolean matches(HttpServletRequest request) {
              for (AntPathRequestMatcher rm : requestMatchers) {
                if (rm.matches(request)) { return true; }
              }
              return false;
            } // method matches
  
          };      
  
  
      http
          .csrf()
          .requireCsrfProtectionMatcher(csrfRequestMatcher)
          .and()
          .authorizeRequests()
              .anyRequest().authenticated()
              .and()
          .requestCache()
              .requestCache(new NullRequestCache())
              .and()
          .httpBasic();
  }
  </code></pre>
  
  <p>and I have following configure(WebSecurity web) method to ignore some of the urls as below;</p>
  
  <pre><code>    public void configure(WebSecurity web) throws Exception {
  
      web.ignoring().antMatchers(
              "/myapp/docs/**",
              "/myapp/docs/*",
              "/myapp/docs/index.html",
              "/resources/**", 
              "/static/**");
  
  }
  </code></pre>
  
  <p>But http request to <a href="http://127.0.0.1:9000/myapp/docs/index.html" rel="nofollow">http://127.0.0.1:9000/myapp/docs/index.html</a> still reuires username/password ( authentication ) and returns  "status":401,"error":"Unauthorized"...
  Actually none of the ignore url on WebSecurity is working since it also requires authentication. If I provide the auth then it works. How can I simply ignore some urls (like "/myapp/docs/**" ) here. I have following definition in the SecurityConfig class </p>
  
  <pre><code>@EnableWebSecurity
  </code></pre>
  
  <p>@EnableGlobalMethodSecurity(prePostEnabled = true)
  public class SecurityConfig extends WebSecurityConfigurerAdapter {</p>
  
  <p>What am I missing ? Please Advise.</p>