Shiro URL based security - it works