- the new deployment.security.use.user.home.java.policy=false in deployment.properties (user's .java.policy file is ignored by default), only documented in public url
http://stackoverflow.com/questions/19407975/java-7-unsigned-applet-permissions-1-7-0-45
- the default behaviour (policy.url.2 is ignored) when using multiple policy files in ${java.home}/lib/security/java.security file
(policy.url.1=file:${java.home}/lib/security/java.policy, policy.url.2=file:${user.home}/.java.policy , policy.url.3=..., ...policy.url.5=...)