From: <glassfish_at_javadesktop.org>
Date: Thu, 24 Jun 2010 11:15:55 PDT

After changing the default-web.xml, then you "need to redeploy" the web application.
And the security-constraint will take effect in the given web application.
If you want the security-constraint apply to / (cf. docroot), then you need to set the default web module in this moment.
[Message sent by forum member 'swchan2']

http://forums.java.net/jive/thread.jspa?messageID=475719