I faced exactly the same issue in a Spring web app. In fact, I had removed spring-security by commenting the config annotation:
// @ImportResource({"/WEB-INF/spring-security.xml"})
but I had forgotten to remove the corresponding filters in web.xml
:
<!-- Filters -->
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
Commenting filters solved the issue.