For example, go to
http://demo.appfuse.org/appfuse-jsf/mainMenu.xhtml
Adding the following to web.xml fixes the problem.
<security-constraint>
<web-resource-collection>
<web-resource-name>Protect XHTML Templates</web-resource-name>
<url-pattern>*.xhtml</url-pattern>
</web-resource-collection>
<auth-constraint/>
</security-constraint>