I am experimenting with spring security and came across a strange behavior. My idea is to create a security filter that authenticates requests based on JWT (or JWS) tokens:<