ViewProviderAccessDelegate uses AccessDecisionManager if available

If an AccessDecisionManager is available for the Security Bean the standard ViewProviderAccessDelegate will use hasAccessToSecuredObject(). Only if not it will use hasAnyAuthority().
This might not work properly if the views have prototype scope, which is quite common. You'd create a new view instance just to check if you have access to it, the throw it away and create another instance that is actually shown.