jmx security
introduce p: to spring xml config files
renames
delete JSESSIONID on logout