Authentication using cookies. Depends on the requested resource and http verb the SecurotyFilter is fired. Keeping state on the client side...