Looking at the following lines of security.xml, the comment should either read "OK to remove line above" OR should be moved up one line.

        <intercept-url pattern="/a4j.res/*.html*" access="ROLE_ANONYMOUS,ROLE_ADMIN,ROLE_USER"/>
        <!-- APF-737, OK to remove line below if you're not using JSF -->
        <intercept-url pattern="/**/*.html*" access="ROLE_ADMIN,ROLE_USER"/>

The comment refers to not needing Ajax4JSF (a4j) if not using JSF.

intercept /**/*.html should NOT be removed - it breaks things by gives unauthenticated users access to non-admin parts of an application.