кот 9 возвращает статус 403

Question

Сервер Tomcat 9 со следующей конфигурацией: server.xml включает UserDatabase Царство с authOnly.

<Realm className="org.apache.catalina.realm.UserDatabaseRealm"
    resourceName="UserDatabase" allRolesMode="authOnly" />
</Realm>

web.xml из примера приложения Tomcat. Добавлено только ограничение безопасности:

    <?xml version="1.0" encoding="ISO-8859-1"?>
    <web-app xmlns="http://java.sun.com/xml/ns/j2ee"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"
        version="2.4">

        <servlet>
            <servlet-name>HelloServlet</servlet-name>
            <servlet-class>mypackage.Hello</servlet-class>
        </servlet>

        <servlet-mapping>
            <servlet-name>HelloServlet</servlet-name>
            <url-pattern>/hello</url-pattern>
        </servlet-mapping>

    <security-constraint>
        <web-resource-collection>
          <web-resource-name></web-resource-name>
          <url-pattern>/*</url-pattern>
        </web-resource-collection>

        <auth-constraint>
          <role-name>*</role-name>
        </auth-constraint>

        <user-data-constraint>
          <transport-guarantee>NONE</transport-guarantee>
        </user-data-constraint>
      </security-constraint>

      <login-config>
        <auth-method>BASIC</auth-method>
      </login-config>
</web-app>

http://localhost:8080/sample/ возвращает статус 403