Another thing you can do in Spring Security 3.1 is add
or
@EnableWebSecurity(debug = true)
to your application context. This adds an extra filter which will (amongs other things) report the list of security filters that will be applied to each request.