The JMX console's web.xml file contains a commented-out definition of JmxOpsAccessControlFilter, which can be used to give read-only access to some users. The xml parser in 5 onward is stricter than it was in 4, and complains that the <description> element if the <init-param>s aren't expected if you just uncomment the section.

The <description> elements need to be moved to before the <param-name> elements.