code: protected boolean validate(String name) {
  
          if (name == null)
              return false;
          if (name.startsWith("java."))
              return false;
  
          return true;
  
      }
docs: Validate a classname. As per SRV.9.7.2, we must restict loading of
  classes from J2SE (java.*) and classes of the servlet API
  (javax.servlet.*). That should enhance robustness and prevent a number
  of user error (where an older version of servlet.jar would be present
  in /WEB-INF/lib).
  
  @param name class name
  @return true if the name is valid