fixing issues:
- introduced some initial separation for controllers (good/bad)
- introduced new files for esapi waf
- started migration to log4j, logback doesn't work with ESAPI