Servlet 3.0 odd declarative security behavior
<security-constraint>
    <web-resource-collection>
        <web-resource-name>LoggedIn</web-resource-name>
        <url-pattern>/screens/*</url-pattern>
    </web-resource-collection>
    <auth-constraint/>
    <user-data-constraint>
        <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
</security-constraint>

<rich:menuItem submitMode="ajax" label="User" action="/screens/user?faces-redirect=true"/>