This week's book giveaway is in the OCPJP forum. We're giving away four copies of OCA/OCP Java SE 7 Programmer I & II Study Guide and have Kathy Sierra & Bert Bates on-line! See this thread for details.
I found a post in JavaRanch titled "environment variable referance in Web.xml". It describes a technique where an environment variable (outside the web.xml) can be processed. This seems similar to what you want, with the one (big) change being that your SecurityFilter must "dereference" the variable. Check it out, and good luck!