With 7u21 we need to make behavior consistent against different JNLPs e.g. if we define j2se version with no href i.e. <j2se version="1.7.0_15"/> , then on IE browser we always launch with latest JRE without showing SSV warning while on firefox/chrome we show SSV warning which is same issue as https://jbs.oracle.com/bugs/browse/JDK-8010827
But if we define j2se version with href attribute i.e. <j2se version="1.7.0_15" href="http://java.sun.com/products/autodl/j2se"/> , then we launch the self signed/all permissions apps with older JRE which is 7u15 in this case without showing SSV warning

And this behavior is only applicable to signed/all-permissions apps, while unsigned and signed sandbox apps will always get launched with secure JRE (though SSV warning could not be there under different scenarios due to existing bugs which already has been triaged and decided to get fixed under 7u25)