Let's say I have 3 sercurity-constrant elements defined in web.xml, everyone pointing to same url-pattern. And I have these 3 auth-constraint element separately defined in each of them:
<security-constraint>
...
<auth-constraint>Role1</auth-constraint>
</security-constraint>
<security-constraint>
...
<auth-constraint>Role2</auth-constraint>
</security-constraint>
<security-constraint>
...
<auth-constraint/>
</security-constraint>
Who can access resource specified in url-pattern? Nobody or Role1 and Role2?