User Role Granted Full Privileges in jetty.xml

The default ConstraintMapping for the "user" role grants privileges to /admin/*, which supersedes the *.action constraint that is supposed to be granted only to the admin role.

The current pathspec for the user role reads:
<property name="pathSpec" value="/api/,/admin/,*.jsp" />

By granting access to /admin/*, that in turn grants access to all of the *.action URLs, essentially nullifying the attempt to restrict *.action URLs to only the admin role.

To repeat, just log in as the default "user/user" account to the web console and add or delete destinations.

Workaround is to change the pathSpec to:

<property name="pathSpec" value="/,.jsp,.css" />

Which allows access to the console but disallows access to the *.action URLs.