Restricting servlet access

[Aleksi Kallio]

In my current setup of Orion it is possible to invoke unmapped servlets by calling 
them with their full packet name (like /servlet/org.comics.FunnyServlet) as long as 
they reside in the classpath. 

How to disallow this?