Encoding filter must be registered before security filter - fixed.