Foundation for Java Web Application Security