perhaps HttpKernel event, rather than application filter? I think it makes it more explicit and also gives a hint as to why it wont work for CLI scripts.