Oracle has thrown us another curve ball with the release of Java 7 u 25.  The new Java VM issues a warning if the jar manifest does not contain the permissions attribute.

http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/no_redeploy.html

We have tested a signed jar that has this added parameter in the manifest and it does indeed remove the warning.  However, the <applet> tag in the HTML page must also contain the following permissions parameter tag

<param name="permissions" value="sandbox" />

http://docs.oracle.com/javase/tutorial/deployment/applet/html.html

If the jar has the permissions specification in the manifest but the <applet> tag does not have that parameter, then the applet will not run.  The opposite is not true.  If the <applet> tag has the permissions parameter and jar manifest does not, then applet will run but gives a warning in the Java Console.  

To prepare for the future, please do the following:  Add the permissions parameter to the Applet tags generated by EJS and the EJS.  This will not break anything in the new Java VM and is backward compatible.  At some point we may need to add the permissions attribute to the manifest and Physlet pages that have this tag will run without annoying warnings.