Used annotations to declare the auth filter, and the filter is
now mapped to all paths, except for those specified in the "excludes"
initialization parameter (comma separated list of URL patterns).