The org.modeshape.web.AuthFilter class uses the sun.misc.BASE64Decoder class. This class is not part of the JDK public API and should not be used; other JDKs might not provide the class.

Please replace this with a call to ModeShape's Base64.decode method, which converts to a byte[] (you can then convert this to a String if needed, or just use the byte[].

BTW, there are several INFO-level log statements; these should be removed or changed to DEBUG or TRACE.