The WebAppClassLoader used by web applications to scope classes does not override
getURLs() to return new URL[0]

This means that if a webapp makes an RMI request using a class from inside the web app,
all the WEB-INF/lib and WEB-INF/classes urls are sent across the wire as class annotations.