code: private SecurityConstraint createSecurityConstraint(SecurityMetadata securityMetadataFromDD, List<WebResourceCollection> webResourceCollections,
                                                          HttpConstraintElement httpConstraint, boolean fromHttpConstraint) {
          List<String> roles = createRoles(httpConstraint);
          List<String> allRoles = securityMetadataFromDD.getRoles();
          for (String role : roles) {
              if (!allRoles.contains(role)) {
                  allRoles.add(role);
              }
          }
          boolean sslRequired = isSSLRequired(httpConstraint);
          boolean accessPrecluded = isAccessPrecluded(httpConstraint);
          boolean accessUncovered = isAccessUncovered(httpConstraint);
          return new SecurityConstraint(webResourceCollections, roles, sslRequired, accessPrecluded, fromHttpConstraint, accessUncovered);
      }
docs: Creates a security constraint from the given web resource collections, url patterns and HttpConstraint element.
  
  @param securityMetadataFromDD the security metadata processed from the deployment descriptor, for updating the roles
  @param webResourceCollections a list of web resource collections
  @param httpConstraint the element representing the information in the @HttpConstraint annotation
  @return the security constraint