Fix is to add a new line in security.xml:

    <bean id="filterInvocationInterceptor" class="org.acegisecurity.intercept.web.FilterSecurityInterceptor">
        <property name="authenticationManager" ref="authenticationManager"/>
        <property name="accessDecisionManager" ref="accessDecisionManager"/>
        <property name="objectDefinitionSource">
            <value>
                PATTERN_TYPE_APACHE_ANT
                /activeUsers.*=admin
                /clickstreams.jsp*=admin
                /flushCache.*=admin
                /passwordHint.html*=ROLE_ANONYMOUS,admin,user
                /myaccount/*.html*=admin,user
                /reload.*=admin
                /signup.html*=ROLE_ANONYMOUS,admin,user
                /ajax4jsf.html*=ROLE_ANONYMOUS,admin,user
                /signup/*.html*=ROLE_ANONYMOUS,admin,user
                <!--NEEDS TO BE ADDED FOR AJAX TO WORK!!! -->
                /a4j.res/*.html*=ROLE_ANONYMOUS,admin,user
                /users.html*=admin
                /**/*.html*=admin,user
            </value>
        </property>
    </bean>

Found, reported and fixed by Sion Smith.