Erro ao acessar localhost:8080/casadocodigo/produtos/

Pessoal tudo bem ?

Estou com problema ao acessar o link Erro ao acessar localhost:8080/casadocodigo/produtos/, quanto tento acessar esta uri sem estar logado a aplicacao quebra. Caso eu acesse sem o /produtos no final, o projeto funciona normalmente.

Segue o pastebin para analise (stacktrace)

https://pastebin.com/zaBmgnf2

meu usuario, modifiquei o nome para username, senha para password.

Spring Securiti

package br.com.casadocodigo.loja.conf;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;

import br.com.casadocodigo.loja.dao.UsuarioDAO;

// classe responsavel por receber as configuracoes do spring
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired(required = true)
    private UsuarioDAO usarioDAO;

    // ira configura as configuracoes e permissoes.
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
            .antMatchers("/produtos/form").hasRole("ADMIN")
            .antMatchers("/carrinho/**").permitAll()
            .antMatchers("/pagamento/**").permitAll()
            .antMatchers(HttpMethod.POST, "/produtos").hasRole("ADMIN")
            .antMatchers(HttpMethod.GET, "/produtos/**").hasRole("ADMIN")
            .antMatchers("/resources/**").permitAll()
            .antMatchers("/").permitAll()
            .anyRequest().authenticated()
            .and().formLogin().loginPage("/login").permitAll()
            .and().logout().logoutRequestMatcher(new AntPathRequestMatcher("/logout"));
    }

    // metodo que cuida dos detalhes dos usuarios
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(usarioDAO).passwordEncoder(new BCryptPasswordEncoder());

    }

    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers("/resources/**");
    }

}

Usuario.

package br.com.casadocodigo.loja.models;

@Entity
public class Usuario implements UserDetails {

    /**
     * 
     */
    private static final long serialVersionUID = -6515237668914804962L;
    @Id
    private String email;
    private String password;
    private String username;

    @OneToMany(fetch = FetchType.EAGER)
    private List<Role> roles = new ArrayList<Role>();

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return this.roles;
    }
    // solitando a senha
    @Override
    public String getPassword() {
        return this.password;
    }


    // solitando o usuario
    @Override
    public String getUsername() {
        return this.email;
    }


    // conta nao expirada
    @Override
    public boolean isAccountNonExpired() {
        return true;
    }


    // conta nao bloqueada
    @Override
    public boolean isAccountNonLocked() {
        return true;
    }


    // credencial nao esta expirada?
    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }

    // esta habilitado 
    @Override
    public boolean isEnabled() {
        return true;
    }

    public String getNome() {
        return username;
    }

    public void setNome(String nome) {
        this.username = nome;
    }

    public String getEmail() {
        return email;
    }

    public void setEmail(String email) {
        this.email = email;
    }

    public String getSenha() {
        return password;
    }

    public void setSenha(String senha) {
        this.password = senha;
    }


    public List<Role> getRoles() {
        return roles;
    }

    public void setRoles(List<Role> roles) {
        this.roles = roles;
    }

    public static long getSerialversionuid() {
        return serialVersionUID;
    }



}

Link do git: https://bitbucket.org/Sleepk/spring-2