I have added @PreAuthorize("hasAnyRole('USER')") in HelloController. Even now if i create token with any user role, still hello controller is returning the result.