How to define realms for using by Google App Engin

I've a security constraint on my app:

<security-constraint>
    <display-name>users</display-name>
    <web-resource-collection>
        <web-resource-name>all</web-resource-name>
        <description/>
        <url-pattern>/secured</url-pattern>
        <http-method>GET</http-method>
        <http-method>POST</http-method>
        <http-method>HEAD</http-method>
        <http-method>PUT</http-method>
        <http-method>OPTIONS</http-method>
        <http-method>TRACE</http-method>
        <http-method>DELETE</http-method>
    </web-resource-collection>
    <auth-constraint>
        <description>Have to be a USER</description>
        <role-name>USERS</role-name>
    </auth-constraint>
</security-constraint>
<login-config>
    <auth-method>BASIC</auth-method>
</login-config>
<security-role>
    <description/>
    <role-name>USERS</role-name>
</security-role>

At runtime however there is no realm "USERS":

2009-06-15 10:25:42.536::WARN: Request /secured failed - no realm

How to define realms under google app engine?
By using jetty.xml? It is onorated by GAE?

I've added WEB-INF/jetty-web.xml:

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE Configure PUBLIC "-//Mort Bay Consulting//DTD Configure 1.1//EN"    
 "http://jetty.mortbay.org/configure_1_2.dtd">
<Configure class="org.mortbay.jetty.webapp.WebAppContext">
  <Get name="securityHandler">
    <Set name="userRealm">
      <New class="org.mortbay.jetty.security.HashUserRealm">
        <Set name="name">MyRealm</Set>
        <Call name="addUserToRole">
          <Arg>dfa</Arg>
          <Arg>*</Arg> <!-- * is a "builtin" realm for GAE -->
        </Call>
        <Call name="put">
          <Arg>dfa</Arg>
          <Arg>secret</Arg>
        </Call>
      </New>
    </Set>
  </Get>
</Configure>

this is correctly deployed on GAE. However when I try to get /secured a plain form http appears but "dfa/secret" is not recognized.

It is a bug?