File Servlet: force http authentication before session