Forgot to mension:

The security profile is added in web.xml as follows

 <security-constraint>
     <display-name>Example Security Constraint</display-name>
     <web-resource-collection>
        <web-resource-name>Protected Area</web-resource-name>
    <!-- Define the context-relative URL(s) to be protected -->
        <url-pattern>/examples/*</url-pattern>
    <!-- If you list http methods, only those methods are protected -->
    <http-method>DELETE</http-method>
        <http-method>GET</http-method>
        <http-method>POST</http-method>
    <http-method>PUT</http-method>
     </web-resource-collection>
     <auth-constraint>
        <!-- Anyone with one of the listed roles may access this area
-->
        <role-name>tomcat</role-name>
    <role-name>role1</role-name>
     </auth-constraint>
   </security-constraint>