Throwing an IAE is more appropriate than just a RuntimeException
exclude retrieving the wsdl from going through the security-filter chain (always allow access)