security filter works - can access protected resources (e.g. /api/clients), but gets 403 errors.