[rules-dev] tomcat security help