Hi Peter,
Unfortunately, this is a bug that occurs when the dsl is enabled, security is enabled and you do a clean build. As a workaround, you can do the clean build twice – the first time the security will be removed, the second time it will be put back. As an alternative, if you are not doing things that will add to the web.xml, you could mark it as read only and it should retain your changes.
There is a bug in our web.xml merger.
I am entering a JIRA and we will have a fix in the next release which will be out in the next month or so.
Let me know if the workarounds don’t work for you.
Thanks,
Jay