This week's book giveaway is in the OCAJP 8 forum. We're giving away four copies of OCA Java SE 8 Programmer I Study Guide and have Edward Finegan & Robert Liguori on-line! See this thread for details.
Directory displays are handled by the DefaultServlet as configured in the default web.xml file. There are a number of configuration parameters, including "listings" - set that to false and Tomcat will not do any directory listings. You could then handle security and file serving in a custom servlet for that application.
You can also create a modified version of DefaultServlet or use XSLT to customize the display generated by DefaultServlet.