Protect '/' explicitly
Use default protection matcher from Spring OAuth