[rules-users] role based authentication in tomcat