title: Prevent Google App Engine from remembering session of non-admin user when using security-constraint
body: <p>I was going through <strong><a href="http://code.google.com/appengine/docs/java/config/webxml.html#Security_and_Authentication" rel="nofollow">this article</a></strong> and got stuck with one issue. Imagine I have following rule in <em>web.xml</em>:</p>
  
  <pre><code>&lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;Admin access&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/AdminPanel.jsp&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
          &lt;role-name&gt;admin&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
  &lt;/security-constraint&gt;
  </code></pre>
  
  <p>Then non-admin user opens AdminPanel.jsp, GAE redirects him to Google Accounts login page, he  enters his credentials and logically gets this page</p>
  
  <pre><code>Error: Forbidden
  Your client does not have permission to get URL /AdminPanel.jsp from this server. 
  </code></pre>
  
  <p>Now I can't re-login with another Google Account because I'm still authenticated as wrong user <strong>and</strong> GAE put <strong>ACSID</strong> cookie for app url. I will always get error message I mentioned above. Is there a way to elegantly solve this issue ? I'd like customer to be able to re-login with appropriate credentials. Also situation when customer is signed into more than one account is possible. I personally have Google Apps account and Gmail account. All Google applications such as GMail have options to Switch in between accounts. Can I do the same ?</p>