rewrite Authfilter to do session handling in the serverSide HttpSession, move listall and add to private directory