move AuthFilter out of resource package
implement a role servlet filter to refuse inactive account access