block sessionless requests when <security> is on. #356