more on embedded tomcat security