TODO spec 13.4.2 appears to say that non-conflicting patterns are
still used.
TODO you can't calculate the eventual security constraint now,
you have to wait until the context is started, since application
code can add url patterns after calling setSecurity.