Java 嵌入式jetty：如何验证静态内容

我使用嵌入式jetty 8.1.16部署我的应用程序。该应用程序有一个目录来存储静态内容（javascript和css文件）。应用程序经过身份验证，但静态内容可以通过其url访问，而无需身份验证。我设置了基于表单的身份验证，如下所示

ServletContextHandler handler = (ServletContextHandler)context; 
handler.addServlet(new ServletHolder(new DefaultServlet() { /* login page*/}), "/login");
Constraint constraint = new Constraint();
constraint.setName(Constraint.__FORM_AUTH);
constraint.setRoles(new String[]{"user"});
constraint.setAuthenticate(true);

ConstraintMapping constraintMapping = new ConstraintMapping();
constraintMapping.setConstraint(constraint);
constraintMapping.setPathSpec("/test-app");

ConstraintSecurityHandler securityHandler = new ConstraintSecurityHandler();
securityHandler.addConstraintMapping(constraintMapping);

HashLoginService loginService = new HashLoginService();
loginService.setConfig("/realm.properties");

FormAuthenticator authenticator = new FormAuthenticator("/login", "/login", false);
securityHandler.setAuthenticator(authenticator);

handler.setSecurityHandler(securityHandler);

静态内容的url为localhost:8080/test-app/js/app.js和localhost:8080/test-app/js/app.css 如何对这些静态内容进行身份验证以防止直接访问url？谢谢