Files should not be served if user is not logged in

[Matt Giuca]

This means that 'null' is passed if the app asks for user info, and bizarrely, creates a "null user" user-game-profile and stores things there.

Instead, it should force the user to log in.

[Prageeth Silva (prageethsilva)]

Adding the following to the web.xml file should do the trick

<security-constraint>
    <web-resource-collection>
      <url-pattern>/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
       <role-name>*</role-name>
    </auth-constraint>
</security-constraint>

Basically accessing any url in the url-pattern ("/*" is the entire website) forces a user (of role any, which includes normal users too; only other option is admin as app specific users can't be used) to be logged in.