What are the best strategies to secure your GWT + Tomcat app to perform authentication and authorization?