jsp-api and servlet-api jars must NOT be deployed by your web app. They should be marked as provided but not deployed by your app.
The server rejects all jars that already belong to the server runtime (such as tomcat-**.jar, servlet**.jar). Consider substituting the CORS filter you're using for this one: https://goo.gl/ctQ7Fs
java.lang.ClassNotFoundException: org.springframework.security.web.FilterChainProxy at java.net.URLClassLoader.findClass(URLClassLoader.java:381)