BZ-998296 Security review: multiple jbpm servlets have no security constraints applied - adding /editor/* url pattern