micronaut-security: Allow 404 global error to be displayed even with a security enabled

Steps to Reproduce

1. Add a global 404 error @Error(status = HttpStatus.NOT_FOUND, global = true)
2. Enable security with micronaut.security.enabled: true
3. Add a controller with parameter like

@Secured(Role.ROLE_CONNECT_READ)
@Controller("/{cluster}/connect")
public class ConnectController {

1. Try to reach every child page like /test/connect/bla
2. be redirected to unauthorized url
3. Disabled security with micronaut.security.enabled: false
4. Try to reach the same page like /test/connect/bla
5. see the 404 page

Expected Behaviour

Security should not change the behavior off 404 page and must be check before security for some use case. The best will be to let user have an option to allow choose if you you want to have a 404 or a unauthorized response.

I think the better option is to allow 404 before unauthorized if the ErrorController is annotated with : @Secured(SecurityRule.IS_ANONYMOUS)

Environment Information

• Operating System: Docker alpine
• Micronaut Version: 1.1.0
• JDK Version: openjdk:8-jre-alpine

Example Application

Full source code is here on branch dev