Example 3.3 Unassigned Security Role Provides All-or-Nothing Control

<security-constraint>
      <web-resource-collection>
      <web-resource-name>SensitiveResources
  </web-resource-name>
      <description>A Collection of Sensitive Resources
  </description>
        <url-pattern>/trade/jsp/internalaccess/
  sensitive1.jsp</url-pattern>
    <url-pattern>/trade/jsp/internalaccess/
  sensitive2.jsp</url-pattern>
    <url-pattern>/trade/jsp/internalaccess/
  sensitive3.jsp</url-pattern>
        <http-method>GET</http-method>
      <http-method>POST</http-method>
    </web-resource-collection>
    <auth-constraint>
      <role-name>sensitive</role-name>
    </auth-constraint>
  </security-constraint>