Reject access to WEB-INF and META-INF paths at the dispatcher level