private void createWebAppContext() {

        contexts = new ContextHandlerCollection();

        WebAppContext context = new WebAppContext(contexts, pluginDir.getAbsoluteFile() + File.separator + "webapp", "/");

        context.setInitParameter("org.eclipse.jetty.servlet.Default.dirAllowed", "false");
        context.setClassLoader(Thread.currentThread().getContextClassLoader());
        context.setAttribute(InstanceManager.class.getName(), new SimpleInstanceManager());
        final URL classes = getClass().getProtectionDomain().getCodeSource().getLocation();
        final ResourceFactory resourceFactory = ResourceFactory.of(context);
        context.getMetaData().setWebInfClassesResources(Collections.singletonList(resourceFactory.newResource(classes)));

        // Add CSP headers for all HTTP responses (errors, etc.)
        context.addFilter(AdminContentSecurityPolicyFilter.class, "/*", null);

        // The index.html includes a redirect to the index.jsp and doesn't bypass
        // the context security when in development mode
        context.setWelcomeFiles(new String[]{"index.html"});
    }
Restart the admin console (and it's HTTP server) without restarting the plugin.
xmppserver/src/main/java/org/jivesoftware/openfire/container/AdminConsolePlugin.java