form based login - tracking - security with struts

[Hartmut Bernecker]

Hi,

I search for the best practice of form based login and security
mechanism based on it.
Who knows a link or wants to contribute some information or hints to the
following themes:

Is it a good practice to forward *all* JSP pages through the action
servlet instead of calling some JSP pages with a direkt link (<a
href="some.jsp">...).

How can JSP pages be hidden so that they can be accessed only via the
central servlet?

TIA
Hartmut Bernecker