commented web-app header for servlet 3.1 added and permissions.xml pretty-formatted