Which two statements are true about the security-related tags in a valid Java EE deployment descriptor?