Move suspicious request check to before filter