added a custom web.xml to the auth war, adds security constraint around ...

...fedora

auth war no longer allows any requests without authN