Make hack (a little) better.  Well, a lot better, since it now works, though it's still hard-coded.  I doubt we'd ever want to do application-level role configs in glassfish-web.xml, so having this be non-optional for now, is OK, in my book.