use web.xml

because java config cannot replace web.xml(e.g. session-timeout,
error-page), so I decide to use web.xml