Could this not be done in `web/WEB-INF/spring/root-context.xml` in the shiro filterChainDefinitions?  Maybe adjusting the `/ = anon` line would have the same effect?