appengine-web.xml (https://developers.google.com/appengine/docs/java/config/appconfig)

appengine-web.xml

<static-files>
  <include path="/my_static-files" >
    <http-header name="Access-Control-Allow-Origin" value="http://example.org" />
  </include>
</static-files>

    <security-constraint>
        <web-resource-collection>
            <web-resource-name>profile</web-resource-name>
            <url-pattern>/profile/*</url-pattern>
        </web-resource-collection>
        <auth-constraint>
            <role-name>*</role-name>
        </auth-constraint>
    </security-constraint>

    <security-constraint>
        <web-resource-collection>
            <web-resource-name>admin</web-resource-name>
            <url-pattern>/admin/*</url-pattern>
        </web-resource-collection>
        <auth-constraint>
            <role-name>admin</role-name>
        </auth-constraint>
    </security-constraint>