How can I exclude a sub-domain from Tomcats security-constraint (web.xml)?

Question

At the end of my /usr/local/apache-tomcat-7.0/conf/web.xml (Tomcat 7), I have added the following configuration:

 <!-- ======== Security Constraint for Development Phase  ======== -->
    <security-role>
        <role-name>tomcat</role-name>
    </security-role>
    <security-constraint>
        <web-resource-collection>
                <web-resource-name>Entire Application</web-resource-name>
                <url-pattern>/*</url-pattern>
        </web-resource-collection>
        <auth-constraint>
                <role-name>tomcat</role-name>
        </auth-constraint>
    </security-constraint>
  <!-- Define the Login Configuration for this Application -->
    <login-config>
        <auth-method>BASIC</auth-method>
        <realm-name>Developers only</realm-name>
    </login-config>

</web-app>

This makes sure only authenticated users with the role 'tomcat' may access any of the web-application on that intance. When accessing the server via the browser an username//password dialog pops up.

Now, I would like to exempt one single sub-domain from that rule, so that no password prompt shows up. (e.g. never prompt for a anything starting with http://foo.example.org)

How can I achieve that?