Improve security of JMX servlet

Enhance security
- localhost is always allowed
- a token can be provided (stored in filesystem, runtime editable)
- check for session (e.g. for Monex) so a logged in (=authorized) user can use the application

restructured code a bit