fix rights on tomcat for security