Locked down dev mode a bit more.
Renamed services for clarity.
Returned 403 for admin request instead of displaying a stack trace.
Factored HTTP param stuff into its own module.
Created a dev filter for a dev login servlet for testing.