added proper error pages via web.xml, and added more robust session checking when posting: cookies & a valid jsession required