try adding spring_security_default_access=permitAll to template