ACEGI @ web.xml

 <session-config>
        <session-timeout>30</session-timeout>
    </session-config>

after 30 minus the session will time out ,the sime as u invoking
session.invalidate();so when in HttpSessionContextIntegrationFilter,
it will create new security context with no auth.so for the proteced
url u can't see it.

the session time out has a defaut time if u didn't set it explicitly.