[Backport 2.x] Allow URL params for Security plugin intercept calls (#1276)

[Backport 2.x] Allow URL params for Security plugin intercept calls (#1276) #2545