Apache authorization doesn't work for jsp's

[dibs dibley]

Hi,
I have an application that serves a number of html files and jsp's.The user must login at the very start using the built in authorization from Apache The <files *.html> tag in the httpd.conf file works fine(ie prompts me for my password, and if i give the wrong one, denies me access), but when I try and use it for <files *.jsp>, it prompts me for my username and password, and if I give a wrong one the page is still served up. I have noticed that any images that should be shown are not if the username/password was wrong, so i'm guessing that tomcat is just ignoring the realm.
Anyone know how to fix this?
Cheers!