improve default adhoc.excludes setting
- check WEB-INF anywhere in the path
- also block paths with META-INF
normalize requested uri