Initial sample servlet-container-based webapp.  Uses the HttpSession currently to retain authentication state.  Next step: allow a sessionless approach (e.g. using a cookie).