fixed a bug:
<sec:authorize access="hasAnyRole('ROLE_STUDENT_PENDING',
'ROLE_STUDENT_INPROCESS', 'ROLE_STUDENT_COMPLETE',
'ROLE_STUDENT_ADMITTED', 'ROLE_STUDENT_DENIED')">