The sample controllers in MiscHttpConfigTests and OpaqueTokenDslTests erroneously use @AuthenticationPrincipal and Authentication together:

public String method(@AuthenticationPrincipal Authentication authentication)

The controllers should remove the @AuthenticationPrincipal annotation.