The current integration done for the web layer resides in the tomcat module of JBAS trunk. The reason was access to the Catalina request object. There is no need for the catalina request object.

The Policy context handlers for the web layer can reside in the security project, utilizing the standard http request object.