#17 investigate <role-name>*</role-name>

[Max Cooper]

Currently, SecurityFilter will allow all users to access
resources that specify <role-name>*</role-name>. I
suspect that SecurityFilter should require <security-role>
elements for each role the application cares about, and
verify that the authenticated user has at least one of the
specified roles to access such a resource.

Needs research (i.e. test on Tomcat, check servlet spec) to
clarify how this should operate, and implementation work to
bring SecurityFilter into compliance.

How does this relate to <security-role-ref> elements?