title: Filtering requests involving security-constraints
body: <p>I have a Java web application that uses security-constraints to lock down access to resources. I'm trying to manipulate the HTTP 401 response when authentication is required for Ajax requests, so I've created a filter that observes the HTTP status in responses and modifies it accordingly if required.</p>
  
  <p>Problem is, it seems that if authentication is required, the filter doesn't get invoked until after the 401 has been sent to the browser. It seems that the security constraint precedes the filter in the request processing chain. My filter's url-pattern is more general than any of the security-constraints. Platform is WebSphere.</p>
  
  <p>I can't see where the precedence of security-constraints and filters is specified in the Servlet 2.5 spec. Have I missed something?</p>