When anonymous has Overall/Read, /configure shows a login form, but /configureSecurity shows a stack trace.
The reason is that the exception nesting doesn't match expectations in UnwrapSecurityExceptionFilter.