Note: For progammatically added Servlets this may not be the
complete set of security constraints since additional
URL patterns can be added after the application has called
setSecurity. For all programmatically added servilets, the
#dynamicServletAdded() method sets a flag that ensures that
the constraints are re-evaluated before the servlet is
first used