The elements MUST be in the same order as the dtd.
Orion probably doesn't validate against the dtd?
Adrian, thanks a lot for a hint!
Reorganizing the web.xml did help! But not everything works still. Jetty throws an IllegalStateException when a user logs out and his HttpSession objects is invalidated :(
Well, moving to another app server is not so simple as it seemed.