title: Apache Shiro Implicit [url] restriction
body: <p>I'm using <a href="http://shiro.apache.org/" rel="nofollow">Apache Shiro</a> to manage my applications security with great success. However, I'm trying to specify a <strong>url</strong> path in my <em>shiro.ini</em> file that will prevent access to a specified page based on the subjects allocated '<em>permissions</em>'.</p>
  
  <p>I know the permissions are generally working as I can use the <code>SecurityUtil</code> to restrict access to methods and functions and this works fine. </p>
  
  <pre><code>SecurityUtils.getSubject().isPermitted("account:create");
  </code></pre>
  
  <p>I am obviously missing something because when I try to apply this through my ini configuration file using the default <strong><em>perms</em></strong> filter the permission seem to be ignored.</p>
  
  <p>Relevant parts of my shiro.ini file:</p>
  
  <pre><code>[urls]
  ...
  /accounts/create.jsf = perms["account:create"]
  ...
  </code></pre>
  
  <p>(obtained from <a href="http://shiro.apache.org/web.html" rel="nofollow">Shiro Docs</a>)</p>
  
  <p>I would have thought that when the specified <strong>url</strong> is accessed the <strong><em>perms</em></strong> filter is instantiated, the subject is found to be lacking the implied permission and the page is not rendered! However the page seems to be rendered just fine. :(</p>
  
  <p>Do I need to create my own implementation of the <strong><em>perms</em></strong> filter and specify its action? I would have thought that was the point of supplying a default!</p>
  
  <p>Any help would be appreciated. </p>