Apache Tomcat Security Constraint Bypass

An error in the fixes for CVE-2011-1088 and CVE-2011-1183 for Apache Tomcat versions 7.0.12 and 7.0.13 meant that security constraints configured via annotations were ignored on the first request to a Servlet. Subsequent requests were secured correctly.

Source: Apache Tomcat Security Constraint Bypass