JSF security notes