Sorry, I won't be accepting any patch that is implemented as you just described. A missing login-required should be interpreted as null, and delegate to the more general widcard. I certainly won't be forcing any kind of DTD update on users, or (worse) accepting any switch that turns this functionality "on". If it doesn't just work, and fit transparently into the current DTD and current behavior, I won't accept the patch. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4028002#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...