The Java filter no longer allows the entire website to be protected with a filter mapping of /*. At some point (I think version 1.5) an enhancemant was made to allow for service overrides as defined in cosignConfig.xml. Two classes - CosignServletCallbackhandler and CosignAuthenticationFilter - try and extract the path portion of the incoming URL to see if it matches the overrides. If there is no path eg for the home page, then an Exception is thrown.
Anonymous