Add the ability to specify truststores and keystores, turn on SSL/TLS, turn on client cert authN, turn on basic authN … and if you do all this … then you actually get a neat little 2-Factor-Authentication (2FA) configured version of tomcat.