Change logic of resource server fallback access rule

Spring Security keeps access rules in a map from request mapping to rule,
so if the user has already added an anyRequest().access(...) it would
have been overwritten by the framework before this change. Ideally we
would have an API from Spring Security to interrogate existing mappings
but in the absence of that, this seems like the best compromise.