Authenticated access urls, excepts login, when security applied

When security setup command executed applicationContext-security.xml has:

<intercept-url pattern="/**" access="permitAll" />

Instead of configure authenticated access urls:

<intercept-url pattern="/login/**" access="permitAll" />
<intercept-url pattern="/**" access="isAuthenticated()" />

There is an exception, the login will still accesible.