Hi,
I just tried your app with latest Glassfish and i do see the security constraint being enforced. When i click on "secret page" link from index.html i am prompted for Username/Password dialog by the browser.
If i give some arbitrary username and password, i then see the following in the browser
HTTP Status 403 - Access to the requested resource has been denied
type Status report
messageAccess to the requested resource has been denied
descriptionAccess to the specified resource (Access to the requested resource has been denied) has been forbidden.
Thanks.
[Message sent by forum member 'kumarjayanti' (kumarjayanti)]
http://forums.java.net/jive/thread.jspa?messageID=226128