protected token exchange URL (web.xml forces HTTPSfpr /login/*)