Through the years I've talked several leads of the servlet spec. and complained about the lack of vendor independent dynamic security, and the answer I've been given has always gone along the same lines "yes, it is lacking, but customers do not complain so it must be enough".
Long ago, I rolled my own solution and then I can deploy my applications on any container and as dynamic as I wish. With the downside that I have to keep the solution myself, but once it was done...
Version 3.0 won't fix it either, so still keep my own :).
[Message sent by forum member 'greeneyed' (greeneyed)]
http://forums.java.net/jive/thread.jspa?messageID=337626