Problemas com segurança no tomcat

Para autenticaçao do usuario eu deveria acrescentar umas tabelas no meu
banco de dados, que eu ja mudei, e alterar a configuraçao do arquivo
conf/server.xml e mudar o web.xml.

O server.xml, depois de algumas tentativas ficou com a seguinte mudança :

"
<!-- Because this Realm is here, an instance will be shared globally
–>

<!-- REALM COMENTADO POR MIM
<Realm className=“org.apache.catalina.realm.MemoryRealm” />
–>
<!-- Replace the above Realm with one of the following to get a Realm
stored in a database and accessed via JDBC -->

<!-- REALM ACRESCENTADO -->

<Realm className="org.apache.catalina.realm.JDBCRealm" debug="99"

driverName=“com.mysql.jdbc.Driver”

connectionURL="jdbc:mysql://localhost/flavia"
            connectionName="user"
            connectionPassword="pass"
            userTable="users" userNameCol="user_name"

userCredCol="user_pass"
userRoleTable=“user_roles” roleNameCol=“role_name”/>

"

Com essa mudança o tomcat “starta” normalmente, sem nenhum erro. Mas ao
mudar o web.xml da minha aplicaçao, acrescentando a parte para a
autenticaçao ocorre o seguinte erro ao starta-lo ( no arquivo
logs/catalina.out ):

PARSE error at line 11 column -1
org.xml.sax.SAXParseException: Root element type is “security-constraint”,
but was declared to be “web-app”.

e passa a nao reconhecer nenhum dos meus arquivos.

abaixo estah o meu web.xml modificado, quando o tomcat inicia normalmente
o web.xml soh possui a parte entre <web-app> e </web-app>, que é a parte
final do arquivo.

web.xml:

<?xml version=“1.0” encoding=“ISO-8859-1”?>

<!DOCTYPE web-app
PUBLIC “-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN”
“http://java.sun.com/dtd/web-app_2_3.dtd”>

<!-- Default login configuration uses form-based authentication -->

<security-constraint>
<display-name>BDBComp Security Constraint</display-name>
<web-resource-collection>
<web-resource-name>Protected Area</web-resource-name>

<!-- Define the context-relative URL(s) to be protected -->

<!–
<url-pattern>*.do</url-pattern>

<url-pattern>*.jsp</url-pattern>

–>
<url-pattern>autor.jsp</url-pattern>

<!-- If you list http methods, only those methods are protected -->
    <http-method>DELETE</http-method>
    <http-method>GET</http-method>
    <http-method>POST</http-method>
    <http-method>PUT</http-method>

</web-resource-collection>

<auth-constraint>

<!-- Anyone with one of the listed roles may access this area -->

<role-name>contribuidor</role-name>

</auth-constraint>
</security-constraint>

<login-config>
<auth-method>FORM</auth-method>
<realm-name>BDBComp Form-Based authentication</realm-name>
<form-login-config>
<form-login-page>/autoarq.jsp</form-login-page>
<form-error-page>/ajuda.jsp</form-error-page>
</form-login-config>
</login-config>

<!-- Security roles referenced by this web application -->

<security-role>
   <role-name>contribuidor</role-name>
</security-role>

<web-app>

<welcome-file-list>
<welcome-file>index.html</welcome-file>
<welcome-file>index.htm</welcome-file>
<welcome-file>index.jsp</welcome-file>
<welcome-file>bdbcomp.jsp</welcome-file>
<welcome-file>ajuda.jsp</welcome-file>
<welcome-file>autoarq.jsp</welcome-file>
</welcome-file-list>

</web-app>

:roll: alguem sabe o que pode estar acontecendo ???