arbitrary non-jsp code is recognized as HTML