Added security into the application. 

Made two roles/group: Users and Admins

Now only /users servlet will be asked to login. This is only for example purposes.

Didn't provide a logout button, but logout can be triggered by navigating to /logout.

This is the way van Soest wants the security. It's not my personal preferences