Moved login checks to serverside, and moved pages to WEB-INF to deny
direct access