Why does using RequestMap allow delete for unauthorized users?
First ReadThe problem with delete is due to the actionSubmit in the generated GSPs. This is a way of putting multiple submit buttons in one form, each sending the action name as a parameter so the controller can figure out which to use. Unfortunately it posts to the ‘index’ action, so URL-based security doesn’t work for this case. There are two options – rework the two buttons to be regular submit buttons each in its own
