servlet class name inside web.xml was not sanitized