JSF 2.0 seems to ignore filter
===

I am using JSF to create some user authorization/check before entering specific pages under secure/ directory but without success... I tried both with phaselistener and filter but stil... Well any help is very welcome.

My web.xml is as follows:

    <filter>
    <filter-name>AuthorizationFilter</filter-name>
    <filter-class>login.security.AuthorizationFilter</filter-class>
    </filter>
    <filter-mapping>
    <filter-name>AuthorizationFilter</filter-name>
    <url-pattern>/secure/*</url-pattern>
    </filter-mapping> 
    <servlet-mapping>
    <servlet-name>Faces Servlet</servlet-name>
    <url-pattern>*.xhtml</url-pattern>
    </servlet-mapping>

AuthorizationFilter looks like this:

    public class AuthorizationFilter implements Filter {
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain  chain) throws ServletException, IOException {    
    HttpServletRequest req = (HttpServletRequest) request;
    login.Login_bean login_bean = (login.Login_bean)
    req.getSession().getAttribute("username");
    if (login_bean != null && login_bean.isLoggedIn()) {
    chain.doFilter(request, response);
    } else {
    HttpServletResponse res = (HttpServletResponse) response;
    res.sendRedirect(req.getContextPath() + "/index.xhtml");
    }
    }

With overriden destroy() and init. It is copy/past from several sites around.

Login_bean is managed and session scoped and when user/pass pair are correct i got this running:

    if(password.equals(dbpassword)){
    FacesContext.getCurrentInstance().getExternalContext().getSessionMap().put("username", username);
    FacesContext.getCurrentInstance().getExternalContext().getSessionMap().put("email", email);
    this.visibleLogout="true";
    this.visibleLogin="false";
    return "valid";
    }


And directory structure looks like:

    WebContent
    -> secure
        -> projects.xhtml
    -> index.xhtml

index.xhtml where i want to prohibit access:

    <p:menuitem id="projects" value="#{menuBean.projectsValue}" action="#menuBean.navTo(projects)}" icon="ui-icon-circle-triangle-e" />.

and finally
menuBean.navTo() is:

    public String navTo(String whereTo)
    {
    return "/secure/projects";
    }

I have hit a wall somehow.. even if change url-pattern to /faces/secure/* i still i am forwarded to projects.xhtml
