/javax.faces.resource/** = anon /resources/** = anon /mobile/** = anon /api/** = anon /wechat/** = anon /login.xhtml = anon /** = authc