For example, go to http://demo.appfuse.org/appfuse-jsf/mainMenu.xhtml

Adding the following to web.xml fixes the problem.

<security-constraint>
        <web-resource-collection>
            <web-resource-name>Protect XHTML Templates</web-resource-name>
            <url-pattern>*.xhtml</url-pattern>
        </web-resource-collection>
        <auth-constraint/>
   </security-constraint>