The Security Manager is independent of the auth-constraints in your app. When you enable the Security Manager additional Permission checks happen for all your accesses.
[Message sent by forum member 'kumarjayanti' (kumarjayanti)]
http://forums.java.net/jive/thread.jspa?messageID=260990