Security中一些可选的表达式
permitAll 永远返回true
denyAll 永远返回false
anonymous 当前用户是anonymous时返回true
rememberMe 当前用户是rememberMe用户时返回true
authenticated 当前用户不是anonymous时返回true
fullAuthenticated 当前用户既不是anonymous也不是rememberMe用户时返回true
hasRole（role） 用户拥有指定的角色权限时返回true
hasAnyRole（[role1，role2]） 用户拥有任意一个指定的角色权限时返回true
hasAuthority（authority） 用户拥有指定的权限时返回true
hasAnyAuthority（[authority1,authority2]） 用户拥有任意一个指定的权限时返回true
hasIpAddress（‘192.168.1.0‘） 请求发送的Ip匹配时返回true
看到上述的表达式，应该能发现一些问题，在Security中，似乎并没有严格区分角色和权限，
如果没有角色和权限的区别，只需要hasRole()函数就够了, hasAuthority()是做什么用的？
答：区别就是，hasRole()的权限名称需要用 "ROLE_" 开头，而hasAuthority()不需要，而且，这就是全部的区别。
在通常的系统设计中，我们区分角色和权限，但是，判断 “用户是不是管理员”，和判断 “是否拥有管理员权限”，在代码逻辑上，其实是完全一致的，角色是一种权限的象征，可以看做是权限的一种。因此，不区分角色和权限，本身就是合理的做法。
如果撇开别的问题不谈，只考虑权限的问题，我们可以将角色视为权限的一种，但是，角色是用户的固有属性，在用户管理上还是非常有必要的，在Security4中，处理“角色”(如RoleVoter、hasRole表达式等)的代码总是会添加ROLE_前缀，它更加方便开发者从两个不同的维度去设计权限。
Spring Security3 到 Spring Security4 的迁移文档：
http://docs.spring.io/spring-security/site/migrate/current/3-to-4/html5/migrate-3-to-4-jc.html#m3to4-role-prefixing
S.O. (Stack Overflow)网站对这个问题的描述：
https://*.com/questions/19525380/difference-between-role-and-grantedauthority-in-spring-security
Think of a GrantedAuthority as being a "permission" or a "right". Those "permissions" are (normally) expressed as strings (with the getAuthority() method). Those strings let you identify the permissions and let your voters decide if they grant access to something.
You can grant different GrantedAuthoritys (permissions) to users by putting them into the security context. You normally do that by implementing your own UserDetailsService that returns a UserDetails implementation that returns the needed GrantedAuthorities.
Roles (as they are used in many examples) are just "permissions" with a naming convention that says that a role is a GrantedAuthority that starts with the prefix ROLE_. There‘s nothing more. A role is just a GrantedAuthority - a "permission" - a "right". You see a lot of places in spring security where the role with its ROLE_ prefix is handled specially as e.g. in the RoleVoter, where the ROLE_ prefix is used as a default. This allows you to provide the role names withtout the ROLE_ prefix. Prior to Spring security 4, this special handling of "roles" has not been followed very consistently and authorities and roles were often treated the same (as you e.g. can see in the implementation of the hasAuthority() method in SecurityExpressionRoot - which simply calls hasRole()). With Spring Security 4, the treatment of roles is more consistent and code that deals with "roles" (like the RoleVoter, the hasRole expression etc.) always adds the ROLE_ prefix for you. So hasAuthority(‘ROLE_ADMIN‘) means the the same as hasRole(‘ADMIN‘) because the ROLE_ prefix gets added automatically. See the spring security 3 to 4 migration guide for futher information.