You only need to configure a realm and loginservice if you're doing any kind of authentication/authorization in your webapp.
You have some kind of configuration mismatch, as the the ConstraintSecurityHandler has had a BasicAuthenticator set up on it - either via jetty xml config or an entry in web.xml - but yet neither the server or the context has had a LoginService set up on it. Your xml snippet shows a FormAuthenticator, yet at runtime it's a BasicAuthencator, so there's something wrong with your config.
If you don't want to do any authentication, take the <login-config> element out of your web.xml (or however you've set up the BasicAuthenticator). Otherwise, you need to provide some type of LoginService, usually set as a bean on the Server instance, but can also be set on the WebAppContext instance in the context xml file (I think you're calling it app.xml?). You haven't provided many details of your setup, but if you have another webapp/context in the mix and it also requires authentication it will also need access to a LoginService: generally, but not necessarily, all webapps share the same LoginService, set as a bean on the Server. If you've only configured a LoginService for one context, the other could be the one producing the stacktrace.
regards
Jan
