Trying to figure out how to use Spring Security to filter URL

Hello All,

I am in the middle of trying to implement Spring security for the first time. I have it authenticating and it gets to my main page. The trouble is that it isn't behaving the way I'd like. I have two users set up for testing, one with ('ROLE_BASIC') and one with ('ROLE_BASIC', 'ROLE_ADMIN', 'ROLE_SUPER'). I have confirmed that the users are being populated with those roles.

So my issue is that the user that only has 'ROLE_BASIC' can access /app/admin/mypage.action' even though I have the intercept-url below. Why is that happening?

security-config.xml

<http>
        <intercept-url pattern='/dacsLogin.htm' filters='none'/>
        <intercept-url pattern='/**' access='ROLE_BASIC' />
        <intercept-url pattern='/admin/**' access='ROLE_ADMIN' />
        <intercept-url pattern='/system/**' access='ROLE_SUPER' />
        <form-login login-page='/dacsLogin.htm' default-target-url='/index.jsp' always-use-default-target='true' />
    </http>

    <authentication-provider user-service-ref='userDetailsService'/>

    <beans:bean id="userDetailsService" class="com.cisco.btd.security.BtdUserDetailsService">
        <beans:property name="userService" ref="userService"/>
    </beans:bean>

I know for sure that the roles are being set because I have a section on one of my pages that has a security check in it:

<sec:authorize ifAllGranted="ROLE_SUPER">
            //links to sys admin pages
        </sec:authorize>


The above will not show for my user that only has 'ROLE_BASIC', but will for the one that has 'ROLE_SUPER'.

Any thoughts?

Jared