JSP files in the war

[Rod Widdowson]

> I'm sure it's obvious, but *view* JSPs are best confined to some place
> under WEB-INF so they can't be invoked directly, 

Its wasn't to me, so thanks for that.  I've made that change in r5951

> whereas JSPs meant to be
> run by the client would then be under /resources.

That I haven't done.  Leaving a jsp file at the top level does make it
accessible, does putting it inside resources gain us anything?

I'm not yet sure why 

https://localhost/idp/shibboleth.jsp 
 
is visible and

https://localhost/idp/image.png

isn't.  

It isn't to do with the jsp view resolver (since I changed that to point
back to WEB-INF).  Or is it?

/Rod