password protected application in tomcat

I am developing a web application using(JSP + Servlet), and I have used `Tomcat 7.0.33` as a `web container`. So my requirement is that each application in tomcat will be `password` protected like the `manager application` in tomcat is protected. So far I have done following: server.xml ``` <Realm className="org.apache.catalina.realm.MemoryRealm" /> ``` tomcat-users.xml ``` <tomcat-users> <role rolename="tomcat"/> <role rolename="manager-gui"/> <role rolename="role1" /> <user username="tomcat" password="tomcat" roles="role1,tomcat,manager-gui"/> <user username="role1" password="tomcat" roles="role1"/> </tomcat-users> ``` web.xml ``` <security-role> <role-name>role1</role-name> </security-role> <security-role> <role-name>tomcat</role-name> </security-role> <security-constraint> <web-resource-collection> <web-resource-name>webappname</web-resource-name> <url-pattern>/*</url-pattern> </web-resource-collection> <auth-constraint> <role-name>role1</role-name> <role-name>tomcat</role-name> </auth-constraint> </security-constraint> <login-config> <auth-method>BASIC</auth-method> <realm-name>webappname</realm-name> </login-config> ``` It works fine when anyone opens the application by application path(it asks for username & password, and application accepts either of the `role1` or `tomcat` for authentication). But the Issue is that suppose if I login as a user `tomcat` who has got all roles, and when the manager screen is shown which lists all the application deployed on the server, then if I try to open `mywebapplication` then it again asks for username and password. My question is that if I have assigned all the `roles` to the user `tomcat` then why it asks for password if I have login as `tomcat`? is there any way to avoid this? Thanks in advance.