configure shiro to allow anonymous access to swagger api