Tomcat is used to serve servlets and JSPs. It can also serve static
content, but not as good as Apache.
The decision to use both depends on your site and needs.. if you'll run 99
dynamic pages out of 100 pages of your site, it would be silly to use
Apache as well..
but if your site is mainly stat
in the folder "$CATALINA8HOME/webapps/examples/jsp/security/protected/"
there are three pages: login.jsp, error.jsp and index.jsp...
and in the server's web.xml there's the security constraint and the login
configuration...
hope it's what you're looking for...
--