Like I said before! There are two ways of handling your first issue. Referencing via the manifest (which is a bit more complex, I agree) or adding stuff to the classpath via the archive attribute (in the html page). Maybe it is best if you use the second alternative like Ulf said. So follow his link and you will be able to fix your problem.
Ulf also has a point when he says that no policy file editing is necessary when no IO tasks are done (or other secure tasks). I assumed however that you altered your policy file because of security issues. Maybe the following link is useful for you to determine whether or not you need to do this.
Applet security One important thing I would like to mention is this: The classes that your web application can/may use have nothing to do with the classes that the applet use. The web application is running in a different virtual machine than the applet. The applet is running on the client that is accessing the web application. The only thing the webserver does is allow the applets' jars to be downloaded to the client. The applets'jars are not included in the classpath of the server. This means that there is nothing you can do in the lib/ext folder of the webapp that will have any result on the applets'classpath.
So if your applet and webserver share classes you will have to put those classes in the applets'jars (classpath) AND in the web-apps'classpath.
