DDF-913 change injection logic to place the delegate filter before all other filters
DDF-913 fixed various issues with security

- removed AssertionWrapper calls in several places that were redundant
- removed calls to getSession without a boolean
- added some additional error checking when creating a subject