OAuth works with security in url intercept mode, but seems not to in annotation mode :(