In the Alfresco Repository webapp web.xml, the filters are defined BeanProxyFilter and spring beans, which means it is possible to easily override a given filter with your own version
However, in the Share webapp, the class name for the SSO filter is hard-coded in web.xml file. If you want to change that class for any reason, you end up having to create your own class with the identical name in the Alfresco namespace, and then hope that you manage to get your version earlier on the classpath
Ideally Share should use the same process as the Repository, to permit easier changing / overriding of the sso filter.
(Making wrapHeaderAuthenticatedRequest and getApplicationContext protected in the class would be nice too, to permit easier overriding of just some bits of behaviour, but isn't as much of an issue)