custom login and logout urls, custom password and username urls, resources and static sources do not pass through filter anymore