I think this test may need to be more generic (i.e. if the user is authenticated at all). Another possibility is that this logic could be embedded into a RequestMatcher