Which statements are true about the auth-constraint element?
1) It only contains the element role-name (besides element description)
2) Only the role-name specified in security-role-ref can be used
3) It is a subelement of web-resource-collection
4) It is related to authentication