So I did more research... and the problem is that people should not go directly TO the login.jsp... but when you use a protected page and get redirected to this action/page, how can you PREVENT people from bookmarking it right then and there? That's what is happening... the login form comes up... people bookmark it. All I can think to do is to have a link saying "bookmark this page" and actually have it bookmark a protected action... what do you think?