form authenticaion and security-constraint question

Does anyone know how to allow public access to a subfolder of a protected path, 
or if it's even possible in Resin?

I am using form authentication for users to login to a web app. The 
form-login-page (/login.html) has graphics that
are in /images/. Those graphics will not show up unless the user has already 
logged in. So can I configure Resin
security-constraint so that / is restricted to "regUser" role, but /images/ is 
public?

I tried         
 <security-constraint url-pattern='/*' role-name='regUser'/>
 <security-constraint url-pattern='/images/*' role-name='*'/>
but it didn't work.

TIA



<!---------------unsolicited ads begin here --------------->





Incroyable ! des SMS offerts avec CaraMail Premium - http://www.caramailmax.com