add security constraints to web.xml