I think your web.xml is missing the following - or at least parts of it since the <login-config>-element is obviously present but not the <form-login-config>-part of it:
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>BroodWeb</realm-name>
<form-login-config>
<form-login-page>/loginform.jsp</form-login-page>
<form-error-page>/loginerror.jsp</form-error-page>
</form-login-config>
</login-config>
This element and its childs are responsible for automatically displaying a loginform-page and an error-page in case of an incorrect login/pwd-combination. Otherwise you are responsible for these pages yourself.
--
Wolfram Rittmeyer
[Message sent by forum member 'writtmeyer' (writtmeyer)]
http://forums.java.net/jive/thread.jspa?messageID=275138