separated web-api into web-api and web-app, and created web-geoserver
use cusrom rest dispatcher so we're out of the /rest context and its security settings
tmp
use the same jettison version than geoserver
tmp