Thank you! It's working now. The main problem was the url-pattern.
The rfs7.xml was something I added as I tried to work through this. Somewhere I found information about adding an xml file specific to the application, but I'll just forget all about that. ;-) I deleted it.
And my tomcat-users did contain users, passwords and roles. I mistakenly posted the wrong file contents.
In any case, thank you very much for the help!