JACC: Security Constraint missing an auth-constraint needs an unchecked permission

Given a snippet

<security-constraint>
<web-resource-collection>
<web-resource-name>MyBit4</web-resource-name>
<url-pattern>/unchecked.jsp</url-pattern>
<http-method>POST</http-method>
<http-method>GET</http-method>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>

This requires an unchecked permission added to the policy as follows:
WebResourcePermission("/unchecked.jsp", (String) null))