Hid enlist.jsp in WEB-INF so it cannot be accessed directly.