Fix bug 15570. Magic role of * was interpreted as all authenticated users rather than as all roles defined in web.xml
tomcat/container/branches/tc4.1.x/catalina/src/share/org/apache/catalina/authenticator/AuthenticatorBase.java