Security bundle couldn't connect to database

Because the security bundle intercepted requests to `/check` (for
logins) before the ConnectionWrapper could connect to the database
signing in didn't work at all.

Fixed by listening to the `kernel.request` event which is the first one
to fire, and setting the event priority to a much higher value
(arbitrarily 100) in `app/config/services.yml`
Access control broken by new URL

All admin pages were accessible because the access controller was
looking for the wrong regex patterns.