samples/expenses/src/main/webapp/WEB-INF/web.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE web-app
    PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
    "http://java.sun.com/dtd/web-app_2_3.dtd">

<web-app>
  <security-constraint>
    <display-name>
      Redirect to the login page if needed before showing
      any html pages
    </display-name>
    <web-resource-collection>
      <url-pattern>*.html</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>*</role-name>
    </auth-constraint>
  </security-constraint>

  <!-- 
  
    Expenses.html and ExpensesMobile.html rely upon RequestFactoryServlet

   -->

  <servlet>
    <servlet-name>requestFactoryServlet</servlet-name>
    <servlet-class>com.google.gwt.requestfactory.server.RequestFactoryServlet</servlet-class>
  </servlet>

  <servlet-mapping>
    <servlet-name>requestFactoryServlet</servlet-name>
    <url-pattern>/gwtRequest</url-pattern>
  </servlet-mapping>

  <filter>
    <filter-name>GaeAuthFilter</filter-name>
    <filter-class>com.google.gwt.sample.gaerequest.server.GaeAuthFilter</filter-class>
    <description>
      This filter demonstrates making GAE authentication
      services visible to a RequestFactory client.
    </description>
  </filter>
  <filter-mapping>
    <filter-name>GaeAuthFilter</filter-name>
    <url-pattern>/gwtRequest/*</url-pattern>
  </filter-mapping>


  <!-- 
  
    LoadExpensesDB.html uses GWT RPC to implement its DataGenerationService

   -->

  <servlet>
    <servlet-name>dataGeneration</servlet-name>
    <servlet-class>com.google.gwt.sample.expenses.server.DataGenerationServiceImpl</servlet-class>
    <description>
      GWT RPC service used by LoadExpensesDB.html
    </description>
  </servlet>
  <servlet-mapping>
    <servlet-name>dataGeneration</servlet-name>
    <url-pattern>/loadexpensesdb/dataGeneration</url-pattern>
  </servlet-mapping>

  <!--<security-constraint> 
    <display-name>
      Require admin access for LoadExpensesDB.html and its servlet
    </display-name>
    <web-resource-collection> 
      <url-pattern>/loadexpensesdb/*</url-pattern> 
      <url-pattern>/LoadExpensesDB.html</url-pattern>
    </web-resource-collection> 
    <auth-constraint> 
      <role-name>admin</role-name> 
    </auth-constraint> 
  </security-constraint>-->


	<!-- 
  
    AppStats 
    
    Uncomment to use GAE's App Stats
    http://code.google.com/appengine/docs/java/tools/appstats.html
    
    Visualize the stats with Speed Tracer
    http://code.google.com/webtoolkit/speedtracer/server-side-tracing.html
    
  -->
  
  <!--<servlet>
    <servlet-name>appstats</servlet-name>
    <servlet-class>com.google.appengine.tools.appstats.AppstatsServlet</servlet-class>
    <init-param>
      <param-name>requireAdminAuthentication</param-name>
      <param-value>false</param-value>
    </init-param>
  </servlet>
  <servlet-mapping>
    <servlet-name>appstats</servlet-name>
    <url-pattern>/appstats/*</url-pattern>
  </servlet-mapping>
  <filter>
    <filter-name>appstats</filter-name>
    <filter-class>com.google.appengine.tools.appstats.AppstatsFilter</filter-class>
    <init-param>
      <param-name>logMessage</param-name>
      <param-value>Appstats available:
        /appstats/details?time={ID}</param-value>
    </init-param>
    <init-param>
      <param-name>basePath</param-name>
      <param-value>/appstats/</param-value>
    </init-param>
  </filter>
  <filter-mapping>
    <filter-name>appstats</filter-name>
    <url-pattern>/*</url-pattern>
  </filter-mapping>-->


  <!-- 
  
    GAE Remote API provides a bulk uploader and other goodies
    
   -->

  <!--  <servlet>
    <servlet-name>remoteapi</servlet-name>
    <servlet-class>com.google.apphosting.utils.remoteapi.RemoteApiServlet</servlet-class>
    <description>
      Provides access to the GAE datastore bulkloader, requires appengine-tools-api.jar
      (which is commented out in pom.xml, qv)
    </description>
  </servlet>
  <servlet-mapping>
    <servlet-name>remoteapi</servlet-name>
    <url-pattern>/remote_api</url-pattern>
  </servlet-mapping>

  <security-constraint> 
    <display-name>
      Require admin access for remoteapi
    </display-name>
    <web-resource-collection> 
      <url-pattern>/remote_api</url-pattern> 
    </web-resource-collection> 
    <auth-constraint> 
      <role-name>admin</role-name> 
    </auth-constraint> 
  </security-constraint>-->

</web-app>