Partial implementation of spring security (remaining is failed logins):
added LoginController, update applicationContext-security.xml.  Move
JSPs from /views/ to /jsp/ to adhere to spring convention.