I know where you are going... If I remove the "haveAuthority" from the /preferences and apply a permitAll, I get a 404... Then you could be thinking.. The controllear beant maybe be not included inside the app context but I double checked and it seems fine for me:
Project Structure
I must be missing something really silly...
Another thing, I made a void method annotated with @PostCOnstruct and debug, and the execution went in... So I guess its included !