Для Grails 3.0.11 и Spring Security Core 3.0.2 добавьте «IS_AUTHENTICATED_ANONYMOUSLY» в application.groovy в разделе:
grails.plugin.springsecurity.controllerAnnotations.staticRules = [
...
..
.
[pattern: '/favicon.ico', access: ['IS_AUTHENTICATED_ANONYMOUSLY']]
]