Extract security.firewalls to standalone definition.

Use request matcher object instead of a simple regex so that only POSTs are caught.
Add comment explaining how to add firewalls properly.