added security to web.xml