changed the filter chain to protect only certain REST urls