Security tweaks around JSF login.xhtml page