401 Unauthorized when failing security constraint of servlet?