I'm using jsf 2 + jaas + ssl + tomcat 6.0.26

I have in my web site 2 paths:

/faces/protected/* which uses SSL

/faces/unprotected/* which don't uses SSL.

I've put this in my web.xml:

<login-config>
        <auth-method>FORM</auth-method>
        <form-login-config>
            <form-login-page>/faces/login.jsp</form-login-page>
            <form-error-page>/faces/error.jsp</form-error-page>
        </form-login-config>
    </login-config>
    <security-constraint>
        <web-resource-collection>
            <web-resource-name>Secure Resource</web-resource-name>
            <description/>
            <url-pattern>/faces/unprotected/*</url-pattern>
            <http-method>GET</http-method>
            <http-method>POST</http-method>
            <http-method>HEAD</http-method>
            <http-method>PUT</http-method>
            <http-method>OPTIONS</http-method>
            <http-method>TRACE</http-method>
            <http-method>DELETE</http-method>           
        </web-resource-collection>
        <auth-constraint>
            <role-name>C</role-name>
        </auth-constraint>          
    </security-constraint>
    <security-constraint>
        <web-resource-collection>
            <web-resource-name>Secure Resource</web-resource-name>
            <description />
            <url-pattern>/faces/protected/*</url-pattern>
            <http-method>GET</http-method>
            <http-method>POST</http-method>
            <http-method>HEAD</http-method>
            <http-method>PUT</http-method>
            <http-method>OPTIONS</http-method>
            <http-method>TRACE</http-method>
            <http-method>DELETE</http-method>
        </web-resource-collection>
        <auth-constraint>
            <role-name>C</role-name>
        </auth-constraint>
        <user-data-constraint>
            <transport-guarantee>CONFIDENTIAL</transport-guarantee>
        </user-data-constraint>     
    </security-constraint>
    <security-role>
        <description> Role Client </description>
        <role-name>C</role-name>
    </security-role>

and this is my server.xml:

 <Connector port="8080" protocol="HTTP/1.1" 
               maxThreads="400"
               maxKeepAliveRequests="1"
               acceptCount="100"
               connectionTimeout="3000"
               redirectPort="8443"
                compression="on"
                compressionMinSize="2048"
                noCompressionUserAgents="gozilla, traviata"
                compressableMimeType="text/javascript,text/css,text/html, text/xml,text/plain,application/x-javascript,application/javascript,application/xhtml+xml"  />


  <Connector port="8443" protocol="org.apache.coyote.http11.Http11AprProtocol" SSLEnabled="true"
               maxThreads="400" scheme="https" secure="true"
               clientAuth="optional" sslProtocol="TLS" 
               SSLCertificateFile="path/to/crt" 
               SSLCertificateKeyFile="path/to/pem"/>

when i enter to protected paths, it switches to HTTPS (port 8443), but when i enter to path /faces/unprotected/somthing... it stays using HTTPS.

what i want is when i enter to unprotected paths, it revert-back to non-SSL communications ( otherwise, i have to re-login again when i set the exact adress in my browser).

What's wrong with my configurations ?

Is there a way so i can do such a thing ?