Does anyone know if Tomcat can restrict access to certain application by IP address (like Apache's .htaccess)?
You add a Valve to the Context in context.xml (specifically, org.apache.catalina.valves.RemoteAddrValve). See the docs on Remote Host Filters.