Example that shows protection by token of a site with redirecting without login
Put the Java code to your sources and the Facelet to the webapp folder. It might work with any Tobago application, and when replacing the token.xhtml tags also with any other JSF application.