code: private SecurityConstraint getConstraintFromHttpElement(SecurityMetadata securityMetadataFromDD, Collection<String> urlPatterns, ServletSecurityElement servletSecurity) {
          List<String> omissionMethods = new ArrayList<String>();
          if (!servletSecurity.getMethodNames().isEmpty()) {
              omissionMethods.addAll(servletSecurity.getMethodNames()); //list of methods named by @HttpMethodConstraint
          }
  
          WebResourceCollection webResourceCollection = new WebResourceCollection((List<String>) urlPatterns, new ArrayList<String>(), omissionMethods, securityMetadataFromDD.isDenyUncoveredHttpMethods());
          List<WebResourceCollection> webResourceCollections = new ArrayList<WebResourceCollection>();
          webResourceCollections.add(webResourceCollection);
          return createSecurityConstraint(securityMetadataFromDD, webResourceCollections, servletSecurity, true);
      }
docs: Gets the security constraint from the HttpConstraint element defined in the given ServletSecurityElement
  with the given list of url patterns.
  
  This constraint applies to all methods that are not explicitly overridden by the HttpMethodConstraint element. The method
  constraints are defined as omission methods in this security constraint.
  
  @param securityMetadataFromDD the security metadata processed from the deployment descriptor, for updating the roles
  @param urlPatterns the list of URL patterns defined in the @WebServlet annotation
  @param servletSecurity the ServletSecurityElement that represents the information parsed from the @ServletSecurity annotation
  @return the security constraint defined by the @HttpConstraint annotation