The filter is not properly handling authentication exceptions. Eg.: LockedAccountException.

This causes the server to return a status code 500 and makes impossible to applications customize the response with a more appropriate status code or message other than that.