Remove http session authentification. Add sf security bind.