Thanks for your comment, I have upvoted it on my Stackoverflow thread. Arjan wrote the answer I have accepted, which can be found at http://stackoverflow.com/a/38976889/2104280 .

Turns out the session behaviour for the login call is not really defined in Servlet 3.0 and may be improved in JSR 375.

On 16 Aug 2016, at 17:25, Claudio Miranda <claudio@claudius.com.br> wrote:

On Tue, Aug 16, 2016 at 4:55 AM, Jan-Willem Gmelig Meyling
<jan-willem@youngmediaexperts.nl> wrote:
And my `web.xml`:

   <login-config>
       <auth-method>BASIC</auth-method>
       <realm-name>MyRealm</realm-name>
   </login-config>

As you want programmatic authentication, there is no need of <login-config>

--
Claudio Miranda

claudio@claudius.com.br
http://www.claudius.com.br