tomcat 7.0.40

Closes #19931.

Signed-off-by: Jack Nagel <jacknagel@gmail.com>