code: public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException,
          ServletException {
          HttpServletRequest httpRequest = (HttpServletRequest)request;
  
          if (securityEnabled && (includeRequest(httpRequest) || !excludeRequest(httpRequest))) {
              doFilterInternal((HttpServletRequest)request, (HttpServletResponse)response, chain);
          } else {
              chain.doFilter(request, response);
          }
      }
docs: If {@code securityEnabled}, passes the request through the chain of {@link RequestSecurityProcessor}s,
  depending if the request URL
  matches or not the {@code urlsToInclude} or the {@code urlsToExclude}. The last processor of the chain calls
  the actual filter
  chain.
  
  @param request
  @param response
  @param chain
  @throws IOException
  @throws ServletException