JSF 2.0 page navigation vs direct page access

Question

I've been experimenting with JSF for some time now and I still don't understand the page navigation part. I know that in JSF, if you aren't using the redirect option in navigation that the URL is one page behind the page you are on.
I've seen articles where people say you should put your pages in a directory under WEB-INF to protect against directly accessing the page. I don't understand how you can create an application that is multiple pages using that option, because won't you run into the problem of having a form with an action URL of WEB-INF/somepage.xhtml?
I've also read articles that say the way to fix this is to add security-constraints to web.xml that prevent "direct access" to pages, when you want your user to follow a page flow, such as start on page1.xhtml, then page2.xthml, then end on page2.xhtml. If page3.xhtml depends on page2.xhtml, the articles I've read say that a security constraint prevents users from simply requesting page3.xhtml out of sequence.
And what happens if the page you are on encounters an error or the session times out, which page handles that? The one you're on, or the one from before that forwarded you to the page you're on?
In this example, should page2.xhtml and page3.xhtml go in the root of the webapps directory, or in a directory under WEB-INF?
Webapps
  index.xhtml
  page1.xhtml
  page2.xhtml
  page3.xhtml
  WEB-INF
    faces-config.xml
    web.xml
    page-directory
      page2.xhtml
      page3.xhtml

Answer 1

A session timeout should actually net a view expiry exception.
You do know that JSF 2.0 made page navigation that bit easier by not requiring you to do the XML configuration? There is now a convention built in plus some new components to add GET enabled requests to the JSF lifecycle (notably h:button and h:link). If you have an action method that returns the following:
public String doSomething(){
  return "something";
}then JSF will by default want to render a view 'something.xhtml' when you don't define any navigation rules. If you want to make that a redirect you can do this:
public String doSomething(){
  return "something?faces-redirect";
}(of course this is a prime target to turn into a utility method on a backing bean base class).
Navigation rules are still necessary when you want to put views in a subdirectory, but at least this way you can greatly simplify general cases. Other than that I can only say: research research research because this material is vital to understand if you want to be productive using the framework; navigation and the 6 JSF lifecycle phases are two items you should put on the top of your list to hammer out until you really get it. A good JSF book will help you immensely there. Balusc's blog is also a good source of deeper understanding:
http://balusc.blogspot.com/
Most of his articles are on JSF 1.2 but most of the information still applies.
Oh and its no surprise that you're a bit confused - this framework is not easy to pick up especially when you don't know any other web frameworks. If you keep running into a wall you should consider checking out something else like Wicket or Play framework. It might just be that JSF simply isn't the tool for the job you're trying to do.