多个<security-constraint>无法正常工作</security-constraint>

Question

我在GlassFish部署的EAR中有以下内容，工作正常：

<security-constraint>
<web-resource-collection>
        <web-resource-name>Secure Pages</web-resource-name>
        <url-pattern>/restricted/*</url-pattern>
        <http-method>GET</http-method>
        <http-method>POST</http-method>
    </web-resource-collection>

    <web-resource-collection>
        <web-resource-name>Secure Pages</web-resource-name>
        <url-pattern>/admin/*</url-pattern>
        <http-method>GET</http-method>
        <http-method>POST</http-method>
    </web-resource-collection>

    <auth-constraint>
        <role-name>admin</role-name>
    </auth-constraint>
</security-constraint>

但是当我添加另一节时，原来仍然有效，但新的安全约束，新的安全约束：

    <security-constraint>       
    <web-resource-collection>
        <web-resource-name>Secure Pages</web-resource-name>
        <url-pattern>/su/*</url-pattern>
        <http-method>GET</http-method>
        <http-method>POST</http-method>
    </web-resource-collection>

    <auth-constraint>
        <role-name>su</role-name>
    </auth-constraint>
</security-constraint>

有没有人看到问题？