Why doesn't spring security let some requests through?

Question

Java

Hello. Help, please, to solve a problem.
Set up Spring security

<http realm="JavaStudy example" use-expressions="false"
          authentication-manager-ref="dao-auth"
          access-decision-manager-ref="accessDecisionManager">
        <intercept-url pattern="/admin**" access="Manager"/>
        <intercept-url pattern="/user**" access="userAvailable"/>
        <!--<intercept-url pattern="/admin/admin**" access="Manager"/>-->
        <!--<intercept-url pattern="/user/user**" access="userAvailable"/>-->
        <form-login login-page="/login" authentication-failure-url="/login-denied"
                    username-parameter="username" password-parameter="password"
                    default-target-url="/main"/>
        <logout invalidate-session="true" logout-success-url="/"
                logout-url="/"/>
        <access-denied-handler error-page="/denied"/>
        <session-management invalid-session-url="/">
            <concurrency-control max-sessions="1"
                                 expired-url="/login"/>
        </session-management>
        <!--remember me-->
        <remember-me token-validity-seconds="1209600"
                     remember-me-parameter="remember-me"
                     user-service-ref="userDetailsService"/>
    </http>

There are two servlets

@RequestMapping(value = "/userNumberOperations", method = RequestMethod.GET)
    public String userNumberOperations(HttpServletRequest request, Locale locale, Model model) {
        User user = (User) request.getSession().getAttribute("currentUser");
        model.addAttribute("contracts", contractService.getAllContractsForUser(user.getUserId()));
        return "user/userNumberOperations";
    }

And exactly the same, but with a different request method

@RequestMapping(value = "/userNumberOperations", method = RequestMethod.POST)
    public String userNumberOperations(HttpServletRequest request, Locale locale, Model model) {
        User user = (User) request.getSession().getAttribute("currentUser");
        model.addAttribute("contracts", contractService.getAllContractsForUser(user.getUserId()));
        return "user/userNumberOperations";
    }

Spring starts up on the first servlet. But when from the page via ajax

var xhr = new XMLHttpRequest();
                                xhr.open("POST", "userNumberOperations, false);
                                xhr.send();

I try to call the second one, security rejects the request and sends me to the /denied page.
Why does he do it?

Answer 1

and cookies in XMLHttpRequest or other login-passwords will Pushkin invest?