Code cleaning
Throw UnknownSessionException when necessary
Enable ShiroFilter for REST api only
Send HTTP 401 when access denied
Troubleshooting login issue