not just those who have one of the roles defined in this web.xml

The special role name �$B!H�(B*�$B!I�(B is a shorthand for all role names
defined in the deployment descriptor. The special role name �$B!H�(B**�$B!I�(B is a
shorthand for any authenticated user independent of role. When
the special role name �$B!H�(B**�$B!I�(B appears in an authorization constraint,
it indicates that any authenticated user, independent
of role, is authorized to perform the constrained requests.