@zcutlip That "security" is sometimes "job security": no one in their mind would use JSF (that produces the exact behavior you describe) unless they can bill by the hour after they locked in the bank with their software built on a (brain)dead framework.