Updated web.xml to separate user permissions