Fix https://bz.apache.org/bugzilla/show_bug.cgi?id=62067 Correctly apply security constraints mapped to the context root using a URL pattern of "" This is the fix for CVE-2018-1304
tomcat/tc8.0.x/trunk/
tomcat/tc8.0.x/trunk/java/org/apache/catalina/realm/RealmBase.java