Spring Security Permitting even unauthenticated user? whats wrong with this code?

Question

I doing a simple poc of spring security but am running in to issues. After extending WebSecurityConfigurerAdapter and implementing own UserDetailsService, spring security is