explanation from the siesta plugin...
```
// We need to import some components from nexus-restlet1x-plugin for SecurityWebFilter, but its use is
// hidden behind guice-servlet muck. We therefore bind it explicitly here so it will get seen by Sisu.
// It would have been preferable to use "requireBinding(SecurityWebFilter.class)" to import the
// SecurityWebFilter instance from nexus-restlet1x-plugin, but guice-servlet only wants to see filters
// bound directly as singletons in this Injector (odd limitation). An alternative would have been to
// requireBinding's for SecuritySystem and FilterChainResolver, which are the filter's dependencies.
```
basically it's down to guice-servlet hiding the use of SecurityWebFilter, so we need to make this explicit so we make sure its dependencies are available - maybe we can do something extra in Sisu to fix this, until then this is the simplest workaround.