I finally found an answer.. I had to add an AntPatternRequestMatcher to the
http.securityMatcher(new AntPatternRequestMatcher("/services/**"))