Symfony 4：删除用户角色后，access_control 不起作用

Question

I'm try to deny access to a user by deleting his role ( ROLE_MEMBER ), here my access_control in security.yaml file :

access_control:
    - { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY, requires_channel: https }
    #- { path: ^/register, roles: IS_AUTHENTICATED_ANONYMOUSLY, requires_channel: https }
    - { path: ^/admin/users, roles: ROLE_SUPER_ADMIN }
    - { path: ^/admin, roles: ROLE_ADMIN }
    - { path: ^/%locale%/.+/(edit|delete|add|request|accept|deny), roles: ROLE_MEMBER }

It appears that it doesn't work. User still have access to, for example, http://localhost:8000/fr/blog/edit/13 and when I display roles like this in a template :

{% for role in app.user.roles %}
    {{ role }}
{% endfor %}

I don't get ROLE_MEMBER so it is well deleted. The fact is that I have to login again to see access_control work.

I would like to know where is stored the user (as mentionned in that question (Point 1 of answer) ) and how to make effect without relogin ?