to reproduce:

• start both applications
• in command line execute curl -H 'Authorization: Bearer whatever' localhost:8080/hello (now you can see hello world)

then remove this line and repeat previous steps (you should not be able to see hello world).