<security:global-method-security secured-annotations="enabled" jsr250-annotations="enabled" pre-post-annotations="enabled"/>

@PreAuthorize("hasRole('MY_SUPER_PUPER_USER')")

@RequestMapping(value = "/company/{webLocal}/profile", method = RequestMethod.GET)
@PreAuthorize("hasRole('USER')")
public ModelAndView profileEdit(@PathVariable String webLocal, HttpServletRequest request, Authentication authentication) {
    ... //тут по webLocal вытаскиваем сущность из базы
}

@RequestMapping(value = "/user/{name}/profile", method = RequestMethod.GET)
@PreAuthorize("hasRole(''{name}")") //Доступ разрешен только для пользователя с именем {name}
public ModelAndView profileEdit() {
 //...
}

@RequestMapping(value = "/local/user/{userName}")
@PreAuthorize("hasRole('AUTHORIZED_USER')") //откидывает анонимусов, юзеров без полномочий
public ModelAndView userPage(@PathVariable String userName, Authentication authentication) {
    OurUserFromBase user = (OurUserFromBase) authentication.getPrincipal();
    if (!user.getName.equalsIgnoreCase(userName)) return new ModelAndView("error");
    return new ModelAndView("page_of_" + user.getName());
}

@RequestMapping(value = "/local/user/{userName}")
public ModelAndView userPage(@PathVariable String userName, @Cookie("some") String token) {
MyUser user =  myUserService.getUserByUserNameAndToken(userName, token); 
    if (user == null) return new ModelAndView("error");
    return new ModelAndView("page_of_" + user.getName());
}

@PreAuthorize("#contact.name == authentication.name")
 public void doSomething(Contact contact);