Adds security constraints to web.xml to block access to pure JSP files
Moves mailreader related JSPs under WEB-INF