use shiro filter chain
use default session storage instead of weak implementation