add static and jsp
fix security and finish login test