Some MVC frameworks allow for leaving out the leading slash from request mappings:

@ApplicationPath("app")

Which can lead folks to use the same pattern in their request matcher:

requestMatchers("app")

However, this has a different meaning in Ant. When what intend is likely:

requestMatchers("/app/**")

Spring Security should remove this ambiguity by failing when a leading slash is missing from any requestMatchers pattern.

Since this wouldn't be passive, for 6.x, we should log a warning message. For 7.x, we should throw an exception.