bug fixed: WebSecurityManager redirection URL doesn't include context path.