I would like to be able to register more path mappings in the PathService, in order to have a plugins-based system (say, Tonic or similar) be able to deploy plugins which require protecting some URLs that are not protected by the main application. (Like, for instance, if I'm adding webwork actions/packages)

Here's a patch that should allow this, by simply exposing the following methods:
public void registerPathMappings(URL fileUrl) throws ParserConfigurationException, IOException, SAXException
public void registerPathMappings(InputStream inputStream) throws ParserConfigurationException, IOException, SAXException
public void registerPathMappings(Document doc)

Please tell me what you think