restricted access to /authorize to ROLE_USER accounts, closes mitreid-connect#892

Author: jricher

openid-connect-server-webapp/src/main/webapp/WEB-INF/user-context.xml

@@ -43,6 +43,7 @@
 
 <security:http disable-url-rewriting="true" use-expressions="true"> 
 <security:form-login login-page="/login" authentication-failure-url="/login?error=failure" authentication-success-handler-ref="authenticationTimeStamper" />
+<security:intercept-url pattern="/authorize" access="hasRole('ROLE_USER')" />
 <security:intercept-url pattern="/**" access="permitAll" />
 <security:custom-filter ref="authRequestFilter" after="SECURITY_CONTEXT_FILTER" />
 <security:logout logout-url="/logout" />

uma-server-webapp/src/main/webapp/WEB-INF/user-context.xml

@@ -125,6 +125,7 @@
 
 <security:http disable-url-rewriting="true" use-expressions="true"> 
 <security:form-login login-page="/login" authentication-failure-url="/login?error=failure" authentication-success-handler-ref="authenticationTimeStamper" />
+<security:intercept-url pattern="/authorize" access="hasRole('ROLE_USER')" />
 <security:intercept-url pattern="/**" access="permitAll" />
 <security:custom-filter before="PRE_AUTH_FILTER" ref="externalAuthenticationFilter" />
 <security:custom-filter ref="authRequestFilter" after="SECURITY_CONTEXT_FILTER" />