This week's book giveaway is in the OCPJP forum. We're giving away four copies of OCA/OCP Java SE 7 Programmer I & II Study Guide and have Kathy Sierra & Bert Bates on-line! See this thread for details.
Directory displays are handled by the DefaultServlet as configured in the default web.xml file. There are a number of configuration parameters, including "listings" - set that to false and Tomcat will not do any directory listings. You could then handle security and file serving in a custom servlet for that application.
You can also create a modified version of DefaultServlet or use XSLT to customize the display generated by DefaultServlet.