code: static WebAppClassLoader createWebAppClassLoader(final ClassLoader cl, final WebAppContext wac)
     {
        return AccessController.doPrivileged(new PrivilegedAction<WebAppClassLoader>() 
        {
           public WebAppClassLoader run()
           {
              try
              {
                 return new WebAppClassLoader(cl, wac);
              }
              catch (IOException ioe)
              {
                 return null;
              }
           }
        });
     }
docs: Create a WebClassLoader
  @param cl The classloader
  @param wac The web app context
  @return The class loader