Is it the true way to implement spring security & CXF webservice

i create a webservice as below:

web.xml

<display-name>MyService</display-name>

<context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>/WEB-INF/beans.xml,/WEB-INF/spring-security.xml</param-value>
</context-param>

<listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>

<servlet>
    <servlet-name>CXFServlet</servlet-name>
    <servlet-class>org.apache.cxf.transport.servlet.CXFServlet</servlet-class>
</servlet>
<servlet-mapping>
    <servlet-name>CXFServlet</servlet-name>
    <url-pattern>/rest/*</url-pattern>
</servlet-mapping>

<!-- Spring Security Filter -->
<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>

<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

beans.xml

<import resource="classpath:META-INF/cxf/cxf.xml" />
<import resource="classpath:META-INF/cxf/cxf-servlet.xml"/> 

<context:component-scan base-package="com.*" />

<jaxrs:server id="employeeService" address="/employeeservices">
    <jaxrs:providers>
        <bean class="org.codehaus.jackson.jaxrs.JacksonJsonProvider" />
    </jaxrs:providers>
    <jaxrs:serviceBeans>
        <ref bean="empService" />
    </jaxrs:serviceBeans>
    <jaxrs:extensionMappings>
        <entry key="xml" value="application/xml" />
        <entry key="json" value="application/json" />
    </jaxrs:extensionMappings>
</jaxrs:server>

<bean id="empService" class="com.service.impl.EmployeeServiceImpl"/>
<bean id="employeeDao" class="com.dao.EmployeeDao"/>

spring-security.xml

<http auto-config="true" use-expressions="true" create-session="stateless" >
    <csrf disabled="true"/>
    <http-basic entry-point-ref="restAuthenticationEntryPoint"></http-basic>
    <intercept-url pattern="/**" access="hasRole('ROLE_USER')" />
</http>

<beans:bean id="userAuthorService" class="com.auth.UserAuthorService"/>
<beans:bean id="restAuthenticationEntryPoint" class="com.auth.UserBasicAuthenticationEntryPoint">
    <beans:property name="realmName" value="Name Of Your Realm"/>
</beans:bean>

<authentication-manager>
    <authentication-provider user-service-ref="userAuthorService">
         <password-encoder ref="bcryptPasswordEncoder"/>
    </authentication-provider>
</authentication-manager>

<beans:bean id="bcryptPasswordEncoder"
    class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder">
    <beans:constructor-arg name="strength" value="5" />
</beans:bean>
<beans:bean id="loggerListener" class="org.springframework.security.authentication.event.LoggerListener"/>

1. By this configuration, is it flow of request process? : request -> Spring security(check authentication) -> cxf -> response.

2. Are there any issues in this configuration when I deploy it in the real sever? what is the standard configuration when using cxf and spring ?

3. when i call right uri:http://localhost:8089/MyService/rest/employeeservices/getemployeedetals?employeeId=004. its ok. But call wrong uri: http://localhost:8089/MyService/rest/employeeservices/getemployeedetallll?employeeId=004. It throw exception:

WARNING: No operation matching request path "/MyService/rest/employeeservices/getemployeedetallll" is found, Relative Path: /getemployeedetal, HTTP Method: GET, ContentType: /, Accept: /,. Please enable FINE/TRACE log level for more details. Jun 07, 2016 1:55:17 PM org.apache.cxf.jaxrs.impl.WebApplicationExceptionMapper toResponse

WARNING: javax.ws.rs.ClientErrorException at org.apache.cxf.jaxrs.utils.SpecExceptions.toHttpException(SpecExceptions.java:110) at org.apache.cxf.jaxrs.utils.ExceptionUtils.toHttpException(ExceptionUtils.java:149) at org.apache.cxf.jaxrs.utils.JAXRSUtils.findTargetMethod(JAXRSUtils.java:477)

So how can i filter the right uri before access controller class.

Please help me. Thank you.