Added - returns json - statements to controller methods.
woo hoo! Spring security now added with basic security enabled! I was missing a reference to the filter DelegatingFilterProxy. This is normally added by default by extending the Initializer with AbstractAnnotationConfigDispatcherServletInitializer  class. I'm doing so with WebApplicationInitializer as it's easier to add new filters. So I went ahead and added the springSecurityFilterChain filter with /* URL pattern.