这是从Springboot安全自动配置，我不得不禁用它手动添加一个配置类：

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter
{
    @Override
    protected void configure(HttpSecurity security) throws Exception
    {
     //security.httpBasic().disable(); // Did work only for GET     
     security.csrf().disable().authorizeRequests().anyRequest().permitAll(); // Works for GET, POST, PUT, DELETE
    }
}