@PreAuthorize should work now, servlet-context wanted to be aware of it
too.