The attached patch lets you define the following properties in your config files:

google.appengine.sessionEnabled = true // default true
google.appengine.enableSsl = true // default true
google.appengine.security.useHttps = ["/secure", "/shoppingcart/*", "/admin"]
google.appengine.security.requireAdmin = ["/admin", "/notsecuredadmin"]
google.appengine.security.requireLogin = ["/admin", "/", "/yabbadabbadoo"]

Based on these definitions, it will provide access control for the google app engine ( like JSecurity / Spring Security ) based on the Google App Engine's security model.

Given that App Engine only allows * and admin roles ( star means the user needs to be logged in, admin means the person needs to be an application admin ), there is no need for more robust declaration of roles.

useHttps in the .appspot.com domain will redirect to https://appname.appspot.com

more on google app engine security here : http://code.google.com/appengine/docs/java/config/webxml.html#Security_and_Authentication