I have the following definition...
To be able to use expressions such as [permitAll] you have to add a a WebExpressionVoter to your AccessDecisionManager