Security is enabled, currently all urls beside login and login failure are blocked from anonymous users