I can get my filter working this way, kinda. The real problem is that
these kinds of filters only have access to the request object. My
filter needs to be able to set (at least) return codes (403, 5XX) and
stop the request if things "go wrong" but the Response object is not
passed in. For the time being I'm doing this as a regular Servlet
filter, unless there is a better way ;-).