关于shiro插件的鉴权

在没有【/news/grid:发布信息】这个权限的情况下
在JSP中该链接被shiro隐藏了【shiro鉴权生效】

  <shiro:hasPermission name="/news/grid:发布信息">
            <a href="/news/add">发布信息</a>
</shiro:hasPermission>

直接访问这个地址，Java Module代码正确执行【shiro鉴权没有生效】并能访问该jsp页面

    @GET
    @At("/add")
    @Ok("jsp:news.add")
    @RequiresPermissions("/news/grid:发布信息")
    public void add() {
       System.out.println("测试");//这句打印会正常输出
    }

POM文件

 <dependency>
            <groupId>org.nutz</groupId>
            <artifactId>nutz-integration-shiro</artifactId>
            <version>1.b.52.r2</version>
        </dependency>
   <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-ehcache</artifactId>
            <version>1.2.4</version>
        </dependency>

shiro.ini文件

[main]
sha256Matcher = org.apache.shiro.authc.credential.Sha256CredentialsMatcher
shiro_realm = com.server.shiro.realm.ShiroRealm
shiro_realm.credentialsMatcher = $sha256Matcher

authc = org.nutz.integration.shiro.CaptchaFormAuthenticationFilter
authc.loginUrl  = /
logout.redirectUrl= /

[urls]
/static/**                = anon
/*                           = authc
/news/**                 = authc