Moved the main user URL to /site so authentication only happens there.
Moved oauth.properties to WEB-INF for security reasons, so that
remote user cannot read the file.