JAAS authentication and role-based authorization is working. Struggling
with annotation-based policies, now web.xml solves the problem.