The problem is not with the user name or password.
The problem lies on your root directory specification. I would need to see the "CVS/Root" to tell you exactly what the correct value would be, but I suspect that you either want to remove the "root/" subpath, or you need to add more to the path.
As for debugging JCVSWeb, it is like any other webapp. You add prints to stderr, or servlet logging. Both require a recompile. I have not had the time to add specific "runtime" debugging code yet.
I did get it working... I did put the wrong CVSPATH because the right one "/IS" was causing me to have to reset Tomcat.
The main issue I was having was that it was expecting a "CVS tag entry" for the cvs module that I was checking out. Trial and error I ended up using "start" as the tag. I don't know why that worked but it did..