Below you can see my SecurityFilterChain bean. I have 3 endpoints in permitAll, but /users/register still needs authorisation, while /users/register/invite/** is fine. Why is this happening?

@Bean
  public SecurityFilterChain resourceServerFilterChain(HttpSecurity http) throws Exception {
    http.authorizeHttpRequests(
            auth ->
                auth.requestMatchers(
                        antMatcher("/actuator/health"),
                        antMatcher(HttpMethod.GET, "/users/register/invite/**"),
                        antMatcher(HttpMethod.POST, "/users/register"))
                    .permitAll()
                    .requestMatchers(antMatcher(HttpMethod.POST, "/users/registrations/invites"))
                    .hasRole("admin")
                    .anyRequest()
                    .authenticated())
        .cors(cors -> cors.configurationSource(corsConfigurationSource(null)));

    http.sessionManagement(
        session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS));
    http.oauth2ResourceServer((oauth2) -> oauth2.jwt(Customizer.withDefaults()));

    return http.build();
  }