Added RequestFilter for security reasons - prevent access to internal
controller actions when session is invalid.