beans-security.xml - trying to redirect user to login page when session
expires.

		<logout invalidate-session="true" logout-success-url="/welcome" />
		<session-management invalid-session-url="/login">
            <concurrency-control max-sessions="1"
                expired-url="/login" />
        </session-management>

web.xml
	<session-config>
		<session-timeout>2</session-timeout>
	</session-config>


updated evaluations page.

When the accountState of an applicant is ‘admitted’ or ‘denied’, hide
the buttons to admit or deny admission, instead print the status. 
then if state is admitted or denied enable the evaluation report to be
generated.