added a sample web.xml so that the WEB-INF directory would be safe