ServiceStack/ServiceStack — pull request #145 by yeurch (2012-05-12 00:04:37+00:00)
Title: Fix to RequestFiltersTests.cs to allow access to insecure services

I added a second service, `Insecure` to RequestFiltersTests.cs and wrote tests calling this service to establish that the request filters (as written) *wrongly* required basic authentication for *ALL* services, although the second filter hints that it should just be requests of type `Secure` that require authentication.

The cause of the problem is that the first filter is calling `res.ReturnAuthRequired()` whenever the basic authentication header is not present, *before* the second filter gets a chance to check if the DTO is `Secure`.

The solution is to never call `res.ReturnAuthRequired()` in the first filter, and leave it to the second filter to do this when a request is for a `Secure` service, and `ss-session` is not present as either a request item or cookie.