So, I have a web-application built on the j2ee framework. In my web.xml we have specified a security constraint to define all .jsp, .js, .java files as protected resources. I however, want to exclude a couple of files from this constraint so that they can be served by the server even when the session/user is not logged in.