title: Spring security core and filterChain chainMap issue
body: <p>Here is my issue: I don't want to use any of spring security core filter when a user is using the API (basically, all /myapi/** request), to avoid creating a useless session. The api is based on oauth token.</p>
  
  <p>So, I'm using the plugin spring-security-core for the user authentication, and I added, in my Config.groovy file, </p>
  
  <pre><code>grails.plugins.springsecurity.filterChain.chainMap = [
  '/myapi/**': 'JOINED_FILTERS,-securityContextPersistenceFilter,-logoutFilter,-authenticationProcessingFilter,-securityContextHolderAwareRequestFilter,-rememberMeAuthenticationFilter,-anonymousAuthenticationFilter,-exceptionTranslationFilter',
  '/**':'JOINED_FILTERS'
  ]
  </code></pre>
  
  <p>Basically, from what I understood, it shouldn't go throught any spring security filter for all /myapi/something, but, actually, it goes throught all the filters as it creates a session (i don't have anything for session in /myapi/something.</p>
  
  <p>But, according to <a href="http://grails-plugins.github.com/grails-spring-security-core/docs/manual/guide/16%20Filters.html" rel="nofollow">http://grails-plugins.github.com/grails-spring-security-core/docs/manual/guide/16%20Filters.html</a></p>
  
  <blockquote>
    <p>So you need a /** catch-all rule at the end for URLs that do not match one of the earlier rules.</p>
  </blockquote>
  
  <p>And that's why I don't understand why the request are still going throught all the filters for any /myapi/something.</p>
  
  <p>Some testing I did, which may help:</p>
  
  <p>It is not creating a session if I only have, in my Config.groovy:</p>
  
  <pre><code>grails.plugins.springsecurity.filterChain.chainMap = [
  '/myapi/**': 'JOINED_FILTERS,-securityContextPersistenceFilter,-logoutFilter,-authenticationProcessingFilter,-securityContextHolderAwareRequestFilter,-rememberMeAuthenticationFilter,-anonymousAuthenticationFilter,-exceptionTranslationFilter'
  ]
  </code></pre>
  
  <p>But it's also not creating a session for the other urls, not using any other filter, which causes the application not to work of course. This example was just to be sure that the session was not created by the /myapi/something request</p>
  
  <p>If i just have:</p>
  
  <pre><code>grails.plugins.springsecurity.filterChain.chainMap = [
  '/myapi/**': 'JOINED_FILTERS'
  ]
  </code></pre>
  
  <p>Then, it goes throught all the filters for all /myapi/something request and create a session. It doesn't use any filter for the other request. It is the excepted behavior.</p>
  
  <p>Thanks a lot for your help, I have been fighting with that for some times now, and any ideas would be more than welcome!</p>
  
  <p>Thanks a lot! Have a good day.</p>