do you have a .java.policy file in the home directory of the account under which you started Glassfish? If so, check to see if you have a grant of allPermission in that file, or server.policy.
you can read more about the Glassfish policy system and how .java.policy can effect it in.
http://blogs.sun.com/monzillo/entry/policy_files_the_securitymanager_and
It is also possible that you have an active authentication session. Typically, you will not be required to authenticate on every access to your application (just your first from a particular browser). You can check this by restarting the appserver, and then trying to access it again.
Ron
[Message sent by forum member 'monzillo' (monzillo)]
http://forums.java.net/jive/thread.jspa?messageID=268555