check auth now handled by SecurityContextHolderAwareRequestWrapper