The Kotlin AuthorizeRequestsDsl has multiple signatures for the authorize method including the following two:
authorize(pattern: String, access: String = "authenticated")
and
authorize(pattern: String, servletPath: String, access: String = "authenticated")
Although the access string is defaulted in the second method, users cannot take advantage of the default value, because supplying 2 strings will always result in the first method being evaluated.
For example, authorize("/path", "x") is equivalent to authorize(pattern = "/path", access = "x") and not authorize(pattern = "/path", servletPath = "x").