Put JSP views inside WEB-INF to limit access to only servlets using the
request dispatcher.