Fix #4 using WEB-INF dir preventing direct access