@Test
fun `request when secured by mvc path variables then responds based on path variable value`() {
    this.spring.register(MvcMatcherPathVariablesConfig::class.java).autowire()
    this.mockMvc.get("/user/user")
        .andExpect {
            status { isOk() }
        }

    this.mockMvc.get("/user/deny")
        .andExpect {
            status { isForbidden() }
        }
}

@EnableWebSecurity
@EnableWebMvc
open class MvcMatcherPathVariablesConfig {
    @Bean
    open fun securityFilterChain(http: HttpSecurity): SecurityFilterChain {
        http {
            authorizeHttpRequests {
                authorize("/user/{userName}", "#userName == 'user'")
            }
        }
        return http.build()
    }

    @RestController
    internal class PathController {
        @RequestMapping("/user/{user}")
        fun path(@PathVariable user: String) {
        }
    }
}

autorhizeRequests {
    authorize("/user/{userName}", "#userName == 'user'")   //invokes authorize with pattern and access
}

authorizeHttpRequests {
    authorize("/user/{userName}", "#userName == 'user'")   //invokes authorize with pattern and servletPath as access type is not String anymore
}