switch back to servlet filter, because shiro filter chain seems to break anonymous access