Tomcat Security Questions