It appears that my problem was in this line:
<mvc:resources mapping="/secured/**" location="/secured/" />
spring-mvc is "confused" where both location and mapping are with the same name. So when a request to a resource enters the application, e.g. .../secured/my.html, spring-mvc does not use the mapping at all.
The solution was to change the location name (or the mapping, but I changed the location-name) so i ended up with:
<mvc:resources mapping="/secured/**" location="/secured_resources/" />
and all my resources (html, JS, etc) were under a dir called 'secured_resources'. Then, when a request arrived to the application, e.g .../secured/my.html, it was mapped successfully using MVC, hence the browser is redirected to login page, etc.