Annotation based security is easy to bypass by adding ".html' to the URL

http://www.grails.org/AcegiSecurity+Plugin+-+Securing+URLs describes that adding a dot, or .html to a URL
bypasses acegi security. For example, if I secure a URL:

http://localhost:8080/project/test

but browse to

http://localhost:8080/project/test.html

the latter URL will NOT be secured by the acegi plugin.

It also describes, that "this will be fixed in Grails 1.1" and "either use annotations or double-map these entries" will solve the problem.

However, using Annotations suffers exactly the same problem.

The following controller:

import org.codehaus.groovy.grails.plugins.springsecurity.Secured

class TestController {

@Secured(['ROLE_ADMIN'])
def index =

}

cannot be reached using /test/index, but CAN be used using /test/index.html.

This is a serious security problem. If the bug cannot be fixed, at least the documentation of the Spring security plugin should mention that you should not use annotation based configuration at all, or it should describe a proper work around.