Doesn't Tomcat support wildcards like *.jsp or *.html at ??

[Me...@Bertelsmann.de]

Hi, 
I've tried to use wildcards for a webresource collection like *.jsp
to denie "guests" to access these pages but it doesn't work with tomcat
3.2.3 
Isn't that defined within the servlet specification?

Sample:
<security-constraint>
	<web-resource-collection>
		<web-resource-name>/jsp/*.jsp</web-resource-name>
		<url-pattern>/jsp/*.jsp</url-pattern>
	</web-resource-collection> 
	<auth-constraint>
		<role-name>admin</role-name>
	</auth-constraint>
</security-constraint>

Can I add a further web-resource-collection in a subdirectory of /jsp and 
give access to everyone? Like   /jsp/images/*  --> role-name = everyone
What is the "everyone" role that requires no password with tomcat 3.2.3?