modified web.xml authentication