no more auth by tomcat