Spreadsheet getFeed failure after authsub on Java GAE/GWT webapp

[Blessed Geek]

I am developing a Java GAE/GWT webapp.

The UI is GWT. The webapp is planned for deployment on GAE. Therefore,
it is developed using GAE/GWT eclipse plugin.

It's a simple app - porting the GDATA sample TableDemo to GAE/GWT.

Here are the steps. TableMgr.jsp actually calls a session bean
MrBean.java to perform the steps and to store session info.

1. Main Page TableMgr.jsp comes on web browser.
Initialises the gdata SpreadsheetService.
this.Service = new SpreadsheetService("Table Manager");

2. User chooses Login.
3. User is presented the Google user auth page, with TableMgr.jsp
itself as the authsub callback page:
<%
String authReqUrl =
AuthSubUtil.getRequestUrl(
"TableMgr.jsp",
"http://spreadsheets.google.com/feeds",
false,
true);
%>
<script type="text/javascript">
location.replace("<%=authReqUrl%>");
</script>

4. User logs in and agrees to grant permission.

5. TableMgr.jsp accepts initial auth token and exchanges it for a
session auth token successfully.

6. TableMgr.jsp sets auth token of SpreadsheetService with session
auth token.

7. TableMgr.jsp needs to present a list of all spreadsheets in the
user's Docs account for user to choose.

Here is where it fails.
Therefore, TableMgr.jsp attempts to initialise a SpreadsheetFeed:

URL feedUrl = this.FeedUrlFactory.getSpreadsheetsFeedUrl();

try {
this.SpreadsheetFeed =
this.SpreadsheetService.getFeed(
feedUrl,
SpreadsheetFeed.class);
}
catch ...

Exception entrails indicate access denied due to failure to establish
cookie.

My question is "What cookie?"

Is getFeed trying to establish a cookie on the jetty server or on the
hosted browser?

[Blessed Geek]

java.security.AccessControlException: access denied
(java.net.NetPermission getCookieHandler)
at java.security.AccessControlContext.checkPermission
(AccessControlContext.java:323)
at java.security.AccessController.checkPermission
(AccessController.java:546)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:
532)
at com.google.appengine.tools.development.DevAppServerFactory
$CustomSecurityManager.checkPermission(DevAppServerFactory.java:122)
at java.net.CookieHandler.getDefault(CookieHandler.java:58)
at com.google.gdata.client.http.GoogleGDataRequest
$GoogleCookieHandler.(GoogleGDataRequest.java:316)
at com.google.gdata.client.http.GoogleGDataRequest
$GoogleCookieHandler.(GoogleGDataRequest.java:305)
at com.google.gdata.client.http.GoogleGDataRequest.
(GoogleGDataRequest.java:408)
at com.google.gdata.client.http.GoogleGDataRequest
$Factory.createRequest(GoogleGDataRequest.java:73)
at com.google.gdata.client.http.HttpGDataRequest$Factory.getRequest
(HttpGDataRequest.java:161)
at com.google.gdata.client.Service.createRequest(Service.java:678)
at com.google.gdata.client.GoogleService.createRequest
(GoogleService.java:525)
at com.google.gdata.client.Service.createFeedRequest(Service.java:
1055)
at com.google.gdata.client.Service.getFeed(Service.java:896)
at com.google.gdata.client.GoogleService.getFeed(GoogleService.java:
631)
at com.google.gdata.client.Service.getFeed(Service.java:916)
at org.synthful.gdata.SpreadsheetFeedsHandler.initSpreadsheetFeed
(SpreadsheetFeedsHandler.java:66)
at com.blessedgeek.gwt.gdata.server.MrBean.readAuthToken(MrBean.java:
40)
at org.apache.jsp.TableMgr.TableMgr_jsp._jspService(TableMgr_jsp.java:
55)
at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:94)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:806)
at org.apache.jasper.servlet.JspServletWrapper.service
(JspServletWrapper.java:324)
at org.apache.jasper.servlet.JspServlet.serviceJspFile
(JspServlet.java:292)
at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:236)
at com.google.appengine.tools.development.PrivilegedJspServlet.access
$101(PrivilegedJspServlet.java:23)
at com.google.appengine.tools.development.PrivilegedJspServlet$2.run
(PrivilegedJspServlet.java:59)
at java.security.AccessController.doPrivileged(Native Method)
at com.google.appengine.tools.development.PrivilegedJspServlet.service
(PrivilegedJspServlet.java:57)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:806)
at org.mortbay.jetty.servlet.ServletHolder.handle(ServletHolder.java:
487)
at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter
(ServletHandler.java:1093)
at
com.google.apphosting.utils.servlet.TransactionCleanupFilter.doFilter
(TransactionCleanupFilter.java:43)
at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter
(ServletHandler.java:1084)
at org.mortbay.jetty.servlet.ServletHandler.handle
(ServletHandler.java:360)
at org.mortbay.jetty.security.SecurityHandler.handle
(SecurityHandler.java:216)
at org.mortbay.jetty.servlet.SessionHandler.handle
(SessionHandler.java:181)
at org.mortbay.jetty.handler.ContextHandler.handle
(ContextHandler.java:712)
at org.mortbay.jetty.webapp.WebAppContext.handle(WebAppContext.java:
405)
at com.google.apphosting.utils.jetty.DevAppEngineWebAppContext.handle
(DevAppEngineWebAppContext.java:54)
at org.mortbay.jetty.handler.HandlerWrapper.handle
(HandlerWrapper.java:139)
at com.google.appengine.tools.development.JettyContainerService
$ApiProxyHandler.handle(JettyContainerService.java:306)
at org.mortbay.jetty.handler.HandlerWrapper.handle
(HandlerWrapper.java:139)
at org.mortbay.jetty.Server.handle(Server.java:313)
at org.mortbay.jetty.HttpConnection.handleRequest(HttpConnection.java:
506)
at org.mortbay.jetty.HttpConnection$RequestHandler.headerComplete
(HttpConnection.java:830)
at org.mortbay.jetty.HttpParser.parseNext(HttpParser.java:514)
at org.mortbay.jetty.HttpParser.parseAvailable(HttpParser.java:211)
at org.mortbay.jetty.HttpConnection.handle(HttpConnection.java:381)
at org.mortbay.io.nio.SelectChannelEndPoint.run
(SelectChannelEndPoint.java:396)
at org.mortbay.thread.BoundedThreadPool$PoolThread.run
(BoundedThreadPool.java:442)