server-webapp/src/main/webapp/WEB-INF/web-sec.xml

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE web-app
    PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
    "http://java.sun.com/dtd/web-app_2_3.dtd">

<!-- Copyright (C) 2010-2011 The University of Manchester See the file "LICENSE" 
	for license terms. -->
<web-app id="TAVSERV-2.5.4">
	<display-name>Taverna 2.5.4 Server</display-name>
	<description>This is the front-end engine for Taverna 2.5.4 Server.</description>
	<context-param>
		<param-name>contextConfigLocation</param-name>
		<param-value>WEB-INF/secure.xml</param-value>
		<description>Where Spring is to load its bean definitions from. DO NOT
			CHANGE WITHOUT CONSULTING DOCUMENTATION.</description>
	</context-param>
	<context-param>
		<param-name>log4jExposeWebAppRoot</param-name>
		<param-value>false</param-value>
		<description>
			THIS IS STUPID! We have to do this so that Tomcat webapps do not
			leak their configurations into each other via the log4j support
			trying to be "smart".
			http://javacolors.blogspot.co.uk/2010/08/tomcat-and-webxmls-webapprootkey.html
			If you change this, good luck hunting down the weird crashes.
		</description>
	</context-param>

	<filter>
		<filter-name>springSecurityFilterChain</filter-name>
		<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
	</filter>
	<filter-mapping>
		<filter-name>springSecurityFilterChain</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>
	<listener>
		<listener-class>
			org.springframework.web.context.request.RequestContextListener
		</listener-class>
	</listener>
	<listener>
		<listener-class>
			org.springframework.web.util.Log4jConfigListener
		</listener-class>
	</listener>
	<listener>
		<listener-class>
			org.springframework.web.context.ContextLoaderListener
		</listener-class>
	</listener>

	<servlet>
		<servlet-name>CXFServlet</servlet-name>
		<display-name>CXF Servlet</display-name>
		<servlet-class>
			org.apache.cxf.transport.servlet.CXFServlet
		</servlet-class>
		<load-on-startup>1</load-on-startup>
	</servlet>

	<servlet-mapping>
		<servlet-name>CXFServlet</servlet-name>
		<url-pattern>/*</url-pattern>
	</servlet-mapping>

	<resource-ref>
		<description>
			Resource reference to a factory for javax.mail.Session
			instances that may be used for sending electronic mail
			messages, preconfigured to connect to the appropriate
			SMTP server.
		</description>
		<res-ref-name>mail/Session</res-ref-name>
		<res-type>javax.mail.Session</res-type>
		<res-auth>Container</res-auth>
		<res-sharing-scope>Shareable</res-sharing-scope>
	</resource-ref>
</web-app>