What security measures should be implemented for a JSF web app using Hibernate and Spring