A paper on our empirical analysis of SecurityManager usage and JSF.