Restricts direct access to JSP files

This PR moves all JSP files in example apps under `WEB-INF` and adds security constraints to `web.xml` to avoid accessing JSP files directly. Thus represents good practises.