Updated web.xml to include .* for the param-name allow param-value and
&lt;script&gt;,%3Cscript%3E for the param-name deny param-value.