Fixes

Made the hostpage a jsp because .html pages bypass filters, so can cause hard to track down bugs.  Users who know enough can change the page to .html to serve it statically, wheras users who run into the filter bypass problem are less likely to be able to solve it.

License indent now looks wrong in the code but looks correct in the app.
What does `varName` stands for? It seems like it's nameToken without the leading slash. Can you keep nameToken in the variable name? `varName` seems a bit generic