为什么REST控制器返回404状态码?

@RestController
@RequestMapping("/documents")
public class DocumentResources {

    private DocumentsMapper mapper;

    public DocumentResources(DocumentsMapper mapper) {
        this.mapper = mapper;
    }

    @PostMapping("/updateDocument")
    public List<Documents> updateDocument (@RequestBody Documents document) {
        mapper.updateDocument(document);
        return mapper.getAllDocuments();
    }
}

以下是我的DocumentsMapper类代码:

@Mapper
public interface DocumentsMapper {
    @Select("select * from documents")
    List<Documents> getAllDocuments();

    @Update("UPDATE documents SET title = #{title}, author = #{author}, src = #{src} WHERE id =#{id}")
    void updateDocument(Documents document);
}

下面是我的AJAX方法:

$( "#target" ).submit(function( event ) {
event.preventDefault();

var formData = {
    id : $("#target #id").val(),    
    title : $("#target #title").val(),
    author :  $("#target #author").val(),
    src: $("#target #src").val(),
    createTime : $("#target #createTime").val(),
    editTime : $("#target #editTime").val()
}

$.ajax({
        url: 'http://localhost:8088/documents/updateDocument',
        type : "POST",
        contentType : "application/json",
        data : JSON.stringify(formData),
        dataType : 'json',
        success : function(result) {
        },
          error: function() {
                window.location = "/error";
                console.log('error', arguments);
              },
                complete: function() {
                console.log('complete', arguments);
              }
            }).done(function() {
              window.location = "/documents";
              console.log('done', arguments);
            });
  });

更新

我刚尝试关闭springsecurity,POST方法就可以访问了。以下是授权功能:

    protected void configure(HttpSecurity http) throws Exception {

     http
        .authorizeRequests()                                                                
            .antMatchers("/resources/**", "/signup", "/about").permitAll()
            .antMatchers("/administrator/**").hasRole("ADMIN") 
            .antMatchers("/users/**").hasRole("ADMIN")
            .antMatchers("/documents/**").hasRole("ADMIN") 
            .antMatchers("/db/**").access("hasRole('ADMIN') and hasRole('DBA')")            
            .anyRequest().authenticated()                                                   
        .and()
            .formLogin()
        .and()
            .logout().logoutSuccessUrl("/login?logout") 
        .and()
            .exceptionHandling().accessDeniedPage("/403")
//          .and()
//              .csrf()
                ;
}

.csrf().disable()