Added picketbox for web-jsf + moved security classes back to services (including workaround for tx issue)