Protecting internal view layer template pages in servlet applications

<!-- Prevent direct access to JSPs. -->
<security-constraint>
    <web-resource-collection>
    	<web-resource-name>JSP templates</web-resource-name>
    	<url-pattern>*.jsp</url-pattern>
    </web-resource-collection>
    <auth-constraint/> <!-- i.e. nobody -->
</security-constraint>