added untested security to web.xml