title: spring security intercept url roles
body: <p>In the spring security intercept-url config, if I define a particular role for a particular path, say ROLE_USER, that path should be accessible only if the user has that authority. That makes sense, but if I set the role as ROLE_ANONYMOUS, <code>&lt;intercept-url pattern="/resources/**" access="ROLE_ANONYMOUS"/&gt;</code> shouldn't it be accessible even when the user is authenticated, say when the user has an authority ROLE_USER? But that doesn't happen.</p>
  
  <p>Here is the log</p>
  
  <pre><code>Checking match of request : '/resources/js/test.js'; against '/resources/**'
  Secure object: FilterInvocation: URL: /resources/js/test.js; Attributes: [ROLE_ANONYMOUS]
  Previously Authenticated:   org.springframework.security.authentication.UsernamePasswordAuthenticationToken***********************************************
  Voter: org.springframework.security.access.vote.RoleVoter@1712310, returned: -1
  </code></pre>
  
  <p>And then i get an access denied exception.I know it works fine if i add <code>&lt;intercept-url pattern="/resources/**" access="ROLE_ANONYMOUS,ROLE_USER"/&gt;</code> in my Http config. But in the above case, is it meant to be like that or am I doing something wrong.</p>