Updated to latest version of QVC, which has a single handler factory.
added a Servlet suffix to the name of the servlet
implemented sessions and used csrfToken to prevent csrf