How is security handled by Tomcat?