code: public void updateSecurityMetadataWithSecurityConstraints(SecurityMetadata securityMetadataFromDD, IServletConfig servletConfig) {
          ServletSecurityElement servletSecurity = servletConfig.getServletSecurity();
          if (servletSecurity != null) {
              Collection<String> urlPatterns = servletConfig.getMappings();
              if (urlPatterns != null) {
                  List<SecurityConstraint> securityConstraintsInDD = null;
                  SecurityConstraintCollection securityConstraintCollectionInDD = securityMetadataFromDD.getSecurityConstraintCollection();
                  // accumulate the list of urlPatternsInDD, patterns for which we have some
                  //  security constraint in the DD that apply to this servlet.
                  Set<String> urlPatternsInDD = new HashSet<String>();
                  if (securityConstraintCollectionInDD != null) {
                      securityConstraintsInDD = securityConstraintCollectionInDD.getSecurityConstraints();
                      for (SecurityConstraint secConstraint : securityConstraintCollectionInDD.getSecurityConstraints()) {
                          for (WebResourceCollection webRescColl : secConstraint.getWebResourceCollections()) {
                              urlPatternsInDD.addAll(webRescColl.getUrlPatterns());
                          }
                      }
                  }
                  List<String> urlPatternsForAnnotations = new ArrayList<String>(urlPatterns);
                  // per spec, constraints from annotations that would match patterns for constraints defined in DD
                  //  should have no effect for those patterns, so remove the patterns.
                  urlPatternsForAnnotations.removeAll(urlPatternsInDD);
                  List<SecurityConstraint> securityConstraints =
                                  createSecurityConstraints(securityMetadataFromDD, servletSecurity, urlPatternsForAnnotations);
                  if (securityConstraintsInDD == null) {
                      securityConstraintsInDD = new ArrayList<SecurityConstraint>();
                  }
                  securityConstraintsInDD.addAll(securityConstraints);
  
                  if (securityConstraintCollectionInDD == null) {
                      securityConstraintCollectionInDD = new SecurityConstraintCollectionImpl(securityConstraintsInDD);
                      securityConstraintCollectionInDD.addSecurityConstraints(securityConstraintsInDD);
                      securityMetadataFromDD.setSecurityConstraintCollection(securityConstraintCollectionInDD);
                  }
              }
          }
      }
docs: Updates the security constraints in the security metadata object (which at this time only has the deployment descriptor info)
  with the servletSecurity element defined in the servlet.
  A servletSecurity element only exists for servlets that have static or dynamic annotations.
  
  @param securityMetadataFromDD the security metadata processed from the deployment descriptor
  @param servletConfig the configuration of the servlet