removed struts related items from looking local, added more robust user check, simpler security using /secure