WEB-INF hiding of list.jsp