 <p>I'm not sure if this would work/help, but you could specify something in your application web.xml.</p> <pre><code> &lt;security-constraint&gt; &lt;display-name&gt;Public access&lt;/display-name&gt; &lt;web-resource-collection&gt; &lt;web-resource-name&gt;PublicPages&lt;/web-resource-name&gt; &lt;description&gt;Public&lt;/description&gt; &lt;url-pattern&gt;/servlet/*&lt;/url-pattern&gt; &lt;/web-resource-collection&gt; &lt;user-data-constraint&gt; &lt;transport-guarantee&gt;NONE&lt;/transport-guarantee&gt; &lt;/user-data-constraint&gt; &lt;/security-constraint&gt; &lt;security-constraint&gt; &lt;display-name&gt;Secured access&lt;/display-name&gt; &lt;web-resource-collection&gt; &lt;web-resource-name&gt;SecuredPages&lt;/web-resource-name&gt; &lt;description&gt;Secured pages&lt;/description&gt; &lt;url-pattern&gt;/services/*&lt;/url-pattern&gt; &lt;/web-resource-collection&gt; &lt;auth-constraint&gt; &lt;description&gt;General Access&lt;/description&gt; &lt;role-name&gt;*&lt;/role-name&gt; &lt;/auth-constraint&gt; &lt;user-data-constraint&gt; &lt;description&gt;SSL not required&lt;/description&gt; &lt;transport-guarantee&gt;NONE&lt;/transport-guarantee&gt; &lt;/user-data-constraint&gt; &lt;/security-constraint&gt; &lt;login-config&gt; &lt;auth-method&gt;BASIC&lt;/auth-method&gt; &lt;realm-name&gt;SecurePages&lt;/realm-name&gt; &lt;/login-config&gt; &lt;security-role&gt; &lt;description&gt;General Access&lt;/description&gt; &lt;role-name&gt;*&lt;/role-name&gt; &lt;/security-role&gt; </code></pre>