Statsfilter now runs after BasicAuthFilter, so can safely rely on req.getRemoteUser returning authenticated user