Basic authentication with sendRedirect doesn't work

Question

Hello from the school of hard knocks:
Following is my web.xml file. It doesn't ask for a username/password but instead gives a "Page not found 404" error. Behind the scenes the unauthorized page is being accessed via sendRedirect(). If I take out the unauthorized page URL in the web.xml and use in-page authentication (see code below), then the browser prompts 3 times and gives the access anyway!!! This is absolutely ridiculous for Tomcat 4.1.29. Can anyone help me out?
<code to force authentication in page gleaned from a thread in this form >
response.setStatus(response.SC_UNAUTHORIZED);
response.setHeader("WWW-Authenticate", "BASIC realm=\"tomcat\"");
<web.xml as prescribed by Martin Bond and Debbie Law in Tomcat - KickStart -- should have been kick in the ass >
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE web-app
PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
"http://java.sun.com/dtd/web-app_2_3.dtd">
<web-app>
<servlet>
<servlet-name>CewolfServlet</servlet-name>
<servlet-class>de.laures.cewolf.CewolfRenderer</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>CewolfServlet</servlet-name>
<url-pattern>/cewolf/*</url-pattern>
</servlet-mapping>
<error-page>
<error-code>401</error-code>
<location>/trnkxref/*</location>
</error-page>
<security-constraint>
<display-name> Web App Access Control - Administrators </display-name>
<web-resource-collection>
<web-resource-name> Administration </web-resource-name>
<url-pattern>/trnkxref/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name> administrator </role-name>
<role-name> patron </role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee> NONE </transport-guarantee>
</user-data-constraint>
</security-constraint>
<login-config>
<auth-method> BASIC </auth-method>
<realm-name>tomcat </realm-name>
</login-config>
</web-app>

Answer 1

Found this in the logs. What does it mean? tomcat-users.xml appended below. Has anyone been reading this lameass thread?
WARNING: Security role name patron used in
an <auth-constraint> without being defined in a <security-role>
tomcat-users.xml:
<?xml version='1.0' encoding='utf-8'?>
<tomcat-users>
<role rolename="patron"/>
<role rolename="administrator"/>
<role rolename="manager"/>
<user username="ldp" password="hello" roles="administrator,patron"/>
</tomcat-users>
~