Your Account
Hear us Roar
req.getRequestDispatcher("WEB-INF/protectedpage.jsp).forward()
to send the client to a JSP under WEB-INF.
The protectedpage.jsp file will not be accessable via a standard get.