added authentication filter + reorganized auth-needed pages to /secured/
removed that annoying /faces url prefix