Did you try the same test case without the security constraint on the welcome page? Or protecting both the css and the welcome page? If you see the issue only when security-constraint is enabled, please attach the test case so that we shall investigate further.
[Message sent by forum member 'nitkal']
http://forums.java.net/jive/thread.jspa?messageID=477787