authentication and authorization removed for development at servlet side, no-reference added to xstream