Refused to display <url> in a frame because it set 'X-Frame-Options' to 'deny'.

.authorizeRequests().antMatchers("/book/**").anonymous().and()

should do the trick

i hope

it didnt

The path is called “books”

oh yeah

that explains it

well problem half-solved

now when its available without auth, it can be seen by google’s pdf viewer iframe thing so i can just rely on google to show previews

ok so it was cache all along