For the following bit:

<security-constraint>
<web-resource-collection>
<web-resource-name>SecureStuff</web-resource-name>
<url-pattern>/excluded.jsp</url-pattern>
<http-method>POST</http-method>
<http-method>GET</http-method>
</web-resource-collection>
<auth-constraint/>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>

There is no need for the generation of a WebUserDataPermission("/excluded.jsp",null) added to the unchecked policy.