Custom filter in apache shiro

I have two sets of users, one is anonymous and the other is valid users (authenticated using the cas server). So for anonymous I have no ticket, but for users I have a ticket. But I want the resource available as with some great function to be exposed to valid users. My resources are available as REST services. So between the two calls (say / foo and / bar. Here / foo needs to be called before / bar) I have to check if the caller is the same or not?

So I would also like to create a ticket for an anonymous user. so in / bar, I can verify that the same anonymous user does indeed have a request / bar.

Can anyone suggest how to solve this problem using apache shiro.

Also, since I have very little knowledge of Apache shiro, I would like to know which one is better than apache shiro or spring security (in case of REST services developed using jersey 2)