jsp bugfixes and more servlet security