Use custom filter chain to filter web services invocations. 

This way we have control of security filters, and can use custom ones if required (which is not the case by now :P)