title: Security constraint in web.xml not getting applied to URL patterns having file extension
body: <p>I have the following security constraints entered in the web.xml. My objective is that the XML files are in the Public area. This works for the <code>/images/*</code> folder. However the url-pattern <code>*.xml</code> does not seem to work. Any ideas ?</p>
  
  <pre class="lang-xml prettyprint-override"><code>    &lt;security-constraint&gt;
          &lt;web-resource-collection&gt;
              &lt;web-resource-name&gt;Public Area&lt;/web-resource-name&gt;
              &lt;url-pattern&gt;/xyz&lt;/url-pattern&gt;
              &lt;url-pattern&gt;/images/*&lt;/url-pattern&gt;
              &lt;url-pattern&gt;/yyz/*&lt;/url-pattern&gt;
              &lt;url-pattern&gt;*.xml&lt;/url-pattern&gt;
          &lt;/web-resource-collection&gt;
      &lt;/security-constraint&gt;
  
      &lt;security-constraint&gt;
          &lt;web-resource-collection&gt;
              &lt;web-resource-name&gt;Super User Area&lt;/web-resource-name&gt;
              &lt;url-pattern&gt;/test/list1&lt;/url-pattern&gt;
              &lt;url-pattern&gt;/test/list2&lt;/url-pattern&gt;
              &lt;url-pattern&gt;/test/list3&lt;/url-pattern&gt;
              &lt;url-pattern&gt;/test/admin.html&lt;/url-pattern&gt;
          &lt;/web-resource-collection&gt;
          &lt;auth-constraint&gt;
              &lt;role-name&gt;SUPER_USER&lt;/role-name&gt;
          &lt;/auth-constraint&gt;
      &lt;/security-constraint&gt;
  
      &lt;security-constraint&gt;
          &lt;web-resource-collection&gt;
              &lt;web-resource-name&gt;Protected Area&lt;/web-resource-name&gt;
              &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
          &lt;/web-resource-collection&gt;
          &lt;auth-constraint&gt;
              &lt;role-name&gt;ADMIN&lt;/role-name&gt;
              &lt;role-name&gt;END_USER&lt;/role-name&gt;
          &lt;/auth-constraint&gt;
      &lt;/security-constraint&gt;
  
  
      &lt;security-role&gt;
          &lt;description&gt;Super User&lt;/description&gt;
          &lt;role-name&gt;SUPER_USER&lt;/role-name&gt;
      &lt;/security-role&gt;
      &lt;security-role&gt;
          &lt;description&gt;Admin User&lt;/description&gt;
          &lt;role-name&gt;ADMIN&lt;/role-name&gt;
      &lt;/security-role&gt;
      &lt;security-role&gt;
          &lt;description&gt;End User&lt;/description&gt;
          &lt;role-name&gt;END_USER&lt;/role-name&gt;
      &lt;/security-role&gt;
  </code></pre>