There is a convention (not necessary) of placing jsp pages under WEB-INF directory so that they cannot be deep linked or bookmarked to.
This way all requests to jsp page must be directed through our application, so that user experience is guaranteed.