private static void initAuthenticator(final Class<? extends ServletRequestAuthenticator> clazz) {
        // Check if we need to reset the auth provider class
        if(clazz == null && servletRequestAuthenticator != null) {
            servletRequestAuthenticator = null;
        } else if (clazz != null && (servletRequestAuthenticator == null || !clazz.equals(servletRequestAuthenticator.getClass()))) {
            try {
                servletRequestAuthenticator = clazz.newInstance();
            }
            catch (final Exception e) {
                Log.error("Error loading ServletRequestAuthenticator {}", clazz.getName(), e);
                servletRequestAuthenticator = null;
            }
        }
    }
Controls whether wildcards are allowed in URLs that are excluded from auth checks.
xmppserver/src/main/java/org/jivesoftware/admin/AuthCheckFilter.java