Strange filter behavior

My securityfilter-config.xml file has the following constraint:

	<security-constraint>
		<display-name>Security constraints for Administrators</display-name>
		<web-resource-collection>
			<web-resource-name>Athlete of the Week</web-resource-name>
			<url-pattern>/aow/admin/*</url-pattern>
		</web-resource-collection>
		<snip/>
		<auth-constraint>
			<role-name>admin</role-name>
		</auth-constraint>
	</security-constraint>

I get the correct behavior when accessing
http://localhost/aow/admin/index.jsp and am sent to the login page. However,
I posted the API for the app, which includes the package for the admin
actions and the URL for the package containing the aow admin actions is:
http://localhost/org/foo/webapp/actions/aow/admin/package-summary.html

This URL obviously inlcludes the /aow/admin/ url-pattern and is triggering
the security constaint. However, the url-pattern was meant by me to be
resolved to the context root, which in this case it is not. Is this the
appropriate behavior? a bug? an incorrect implementation on my part?

Any info would be appreciated.

Thanks.

-Dan



-------------------------------------------------------
This sf.net email is sponsored by: Are you worried about 
your web server security? Click here for a FREE Thawte 
Apache SSL Guide and answer your Apache SSL security 
needs: http://www.gothawte.com/rd523.html