KeycloakSecurityContext session = (KeycloakSecurityContext) getServletRequest().getAttribute(KeycloakSecurityContext.class.getName());
String token = session.getIdTokenString();

I use this token to add an header to every call:
$httpProvider.defaults.headers.common.Authorization = 'Bearer '+keycloak.token;

I see my backend is authenticating the call infact:
2014-04-15 00:00:52,868|INFO |adapters.RequestAuthenticator|Bearer AUTHENTICATED

Now I have a different issue, that I hope you can help to figure out.

On the browser I see two calls:
1- I dont expect, it is an OPTIONS call
2- I expected, it fails is a GET call 

I try to do the second call directly with cURL:
curl 'http://localhost:8000/1/documents/' -H 'Accept: application/json, text/plain, */*' -H 'Referer: http://localhost:8080/dashboard/' -H 'Origin: http://localhost:8080' -H 'Authorization: Bearer eyJhbGciOiJSUzI1NiJ9.eyJqdGkiOiI2ZWIwYzc1Mi1kZTc2LTQ1ZjQtYTAxNi1mMTQ1OTZmMTc1OTUiLCJleHAiOjEzOTc1MTYyMTgsIm5iZiI6MCwiaWF0IjoxMzk3NTE1OTE4LCJpc3MiOiJiaWxsZHJhd2VyIiwiYXVkIjoiYmlsbGRyYXdlciIsInN1YiI6IjQyNGZlZDlkLTk3MDQtNDUwNS04NTcwLWQ4N2I5MWVjNDM1NCIsImF6cCI6IndlYnNpdGUiLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJkYXZpZGUifQ.epRcVbsN_wS44uOMOCyCQ6qkj8JAFn875-N_QYIakom4SPFYBWjU9jS9eBdXsvltwlT-NjlmCOlzbjGT32ZN0bj-_oQ449G9pN35tzzIN0_HXM14cIGdyOchluu4DQz3W6ZKF5m1jm6aFmwPD39ld_Zn7yGoBPPh_3qaYNFy-wl8YJBCCb34BvSRLZhtGdcVLYT4EJW8Y3R_YSnybrPqKr8eJOriLWOl-VOAJrtxT-MAvTDo0rXSubvpZF1CwQKuXHC9AkJ-NM582puVUZkZXt0AgBGJOjxlV7zJr4hLPYaXUG9JX2KMQUMvkhpXuug_tmu1ZR43UnxwLzoJey9C2Q' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.152 Safari/537.36' --compressed

And the response is:
<html><head><title>Error</title></head><body>Forbidden</body></html>

If I try:
curl 'http://localhost:8000/1/documents/' -H 'Accept: application/json, text/plain, */*' 
The response is:
<html><head><title>Error</title></head><body>Unauthorized</body></html>%   

What am I doing wrong?

I tried to put play with annotation @RolesAllowed("user") on the JAX-RS but it does not the difference. 