Maybe we should protect those methods? By the way we had a bug on this last week, you should do something like @RolesAllowed(AuthoritiesConstants.ROLE_ADMIN)