It sometimes has to catch an exception from the security filter so
it needs to be before, and somehow this hasn't been a problem up to
now, but probably only by some fluke.

Fixes gh-5792