Shiro security plugin does not handle public urls