add whoami.jsp and logout.jsp to play with authentication