javadoc doesn't match with how the servlet is actually configured. i.e. the servlet isn't secured.