need to explicitly set unprotected security-constraint to /*
or servlet container applies form-login to _all_ URLs 
(detected on tomcat 7.0.50)