"i am sure programmatically you can restrict users.". Yes, this is what I'm looking for but don't know how to do that with request mappings. They look like restriction based on URL patterns and ROLE.