Grab the sources and deploy: https://github.com/abstractj/aerogear-controller-demo/tree/picketlink_beta4

Run:

curl -v -X OPTIONS "http://localhost:8080/aerogear-controller-demo/mycars"

It shouldn't return the output (because this endpoint is protected):

• Connection #0 to host corscontroller-abstractj.rhcloud.com left intact
  ["Brawn","Bumblebee","Cliffjumper","Beachcomber","Optimus Prime"]* Closing connection #0