Confused About Context Of JNDI Data Souce On Tomcat 6

Question

I just finished deploying jtrac (http://jtrac.info) on a Tomcat 6 instance. I wanted to run the application on top of a Mysql database and use a JNDI datasource. To make everything work, I had to do the following:

First, I had to put a data source in my /etc/tomcat6/context.xml file that looks like this:

<Resource name="jdbc/JtracDB" 
    auth="Container"
    type="javax.sql.DataSource" 
    username="jtracdbo" 
    password="somepass"
    driverClassName="com.mysqsl.jdbc.Driver"
    url="jdbc:mysql://localhost:3306/jtracdb"
    maxActive="100" 
    maxIdle="30"
    maxWait="10000"  />

And then I had to reference the data source using a property that looks like this:

database.datasource.jndiname=java:comp/env/jdbc/JtracDB

So here's my questions:

1. I'm assuming that any app that is deployed on this Tomcat instance can access this data source. Isn't that a security vulnerability? Is there a better place I can put this data source without unpacking the war file?
2. When referencing the data source, why is it necessary to put the "java:comp/env/" part in front of it? And is that true for every data source that I define in context.xml?