problemas com filter - JSF/Hibernate

@ManagedBean(name="loginBean")
@SessionScoped
public class LoginBean {
    
    private Usuario usuario;

    public LoginBean() {
        
        if (this.usuario == null) {
            this.usuario = new Usuario();
        }
    }
        
    public void redirecionar() throws IOException{    
       FacesContext faces = FacesContext.getCurrentInstance();
        ExternalContext context = faces.getExternalContext();
        context.redirect("/ControleChanges/index.jsf");   
    }  
    
    public void login(ActionEvent actionEvent) throws IOException {
        RequestContext context = RequestContext.getCurrentInstance();
        FacesMessage msg = null;
        boolean loggedIn = false;
        
        UsuarioDao usuarioDao = new UsuarioDaoImpl();
        usuario = usuarioDao.buscarPorUsuario(usuario);

        if (usuario != null) {
            loggedIn = true;
            FacesContext.getCurrentInstance().getExternalContext().getSessionMap().put("user", "ok");
            redirecionar();
            msg = new FacesMessage(FacesMessage.SEVERITY_INFO, "Welcome", usuario.getUsername()); //"Usuario"
        } else {
            loggedIn = false;
            msg = new FacesMessage(FacesMessage.SEVERITY_WARN, "Login Error", "Invalid credentials");
        }

        FacesContext.getCurrentInstance().addMessage(null, msg);
        context.addCallbackParam("loggedIn", loggedIn);
    }

    public Usuario getUsuario() {
        if (usuario == null){
            usuario = new Usuario();
        }
        return usuario;
    }

    public void setUsuario(Usuario usuario) {
        this.usuario = usuario;
    }
    
    
}

public class UsuarioDaoImpl implements UsuarioDao {
   
    @Override
    public Usuario buscarPorUsuario(Usuario usuario) {
        Session session = HibernateUtil.getSessionFactory().openSession();
        String sql = "select u from Usuario u where username=:user and password=:pass";
        Query query = session.createQuery(sql);
        query.setString("user", usuario.getUsername());
        query.setString("pass", usuario.getPassword());
        return (Usuario) query.uniqueResult();
    }
}

public class AuthFilter implements Filter {

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest rq = (HttpServletRequest) request;
        HttpServletResponse rp = (HttpServletResponse) response;
        boolean auth = rq.getSession().getAttribute("user") != null;

        if (!auth && !rq.getRequestURL().toString().contains("login.jsf")) {
            rp.sendRedirect(rq.getContextPath() + "/login.jsf");
        } else {

            try {
                chain.doFilter(request, response);
            } catch (Exception e) {
                e.printStackTrace();
            }
        }
    }

    public void destroy() {
    }

    public void init(FilterConfig config) throws ServletException {
    }
}