dist folder only part of end product
seal off @ServeletSecurity from web root
merge with webApp dir