Spring security filter called twice - spring

Question

I just realized that the OAuth2AuthenticationProcessingFilter is called twice when accessing the protected resource /me in my OAuth auth server:
An abstract of my xml config:
<http pattern="/me/**" create-session="stateless" entry-point-ref="oauthAuthenticationEntryPoint" use-expressions="true"
xmlns="http://www.springframework.org/schema/security">
<anonymous enabled="false" />
<intercept-url pattern="/me/**"
access="hasRole('ROLE_USER') and #oauth2.clientHasRole('ROLE_CLIENT') and #oauth2.hasScope('read')" />
<!-- Protect the resource with oauth by using the resourceServerFilter-->
<custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
<access-denied-handler ref="oauthAccessDeniedHandler" />
<expression-handler ref="oauthWebExpressionHandler" />
<request-cache ref="requestCache" />
</http>
and
<http access-denied-page="/login?authorization_error=true" disable-url-rewriting="true"
xmlns="http://www.springframework.org/schema/security" use-expressions="true">
<intercept-url pattern="/oauth/**" access="hasRole('ROLE_USER')" />
<!-- /secure/** is protected and for users only. Don't allow oauth2 clients to access protected UI pages.
Put all secured web pages under /secure (e.g. /secure/profile) -->
<intercept-url pattern="/secure/**" access="hasRole('ROLE_USER') and #oauth2.denyOAuthClient()" />
<!-- Allow access to everything else -->
<intercept-url pattern="/**" access="permitAll()" />
<form-login authentication-failure-handler-ref="authenticationFailureHandler"
login-page="/login" login-processing-url="/login.do" authentication-success-handler-ref="customAuthenticationSuccessHandler" />
<!-- See also LogoutFilterPostProcessor -->
<logout logout-url="/logout.do" delete-cookies="JSESSIONID" success-handler-ref="lclSessionCookieDeletingLogoutHandler" />
<anonymous />
<!-- Allow the usage of oauth web expressions (e.g. '#oauth2.denyOAuthClient()') -->
<expression-handler ref="oauthWebExpressionHandler" />
<request-cache ref="requestCache" />
<csrf token-repository-ref="csrfTokenRepository"/>
<remember-me services-ref="persistentTokenBasedRememberMeServices" key="abcdefg"/>
<custom-filter ref="forcePasswordResetFilter" before="REQUEST_CACHE_FILTER" />
</http>
It seems as if the filters from the second <http/> section (e.g. the ForcePasswordResetFilter) are also applied when /me is called - which is not what I'd expect. Any ideas why not only the first <http/> section is considered which matches /me/**?