Move database script to WEB-INF.

Reason: security, prevent user to GET file in "db" directory.