Prevent viewing of source files - security-constraint

Question

I'm using JSF and Facelets and I'd like to restrict visibility of the .xhtml source files.
Currently if a user types in the source file name index.xhtml instead of index.jsf in the url they get presented with the raw source file.
I've got a blanket security constraint that requires authentication of all users and I've added a second constraint that denies access to .xhtml files.
This doesn't work I imagine because the first constraint is allowing access to all pages.
I'd appreciate some suggestions how I can stop users viewing the .xhtml files while requiring authentication for all pages.
<security-constraint>
<display-name>Secure Pages</display-name>
<web-resource-collection>
<web-resource-name>Secure Pages</web-resource-name>
<description/>
<url-pattern>/*</url-pattern>
<http-method>..snip..</http-method>
</web-resource-collection>
<auth-constraint>
<description/>
<role-name>User</role-name>
</auth-constraint>
</security-constraint>
<security-constraint>
<display-name>Source Files</display-name>
<web-resource-collection>
<web-resource-name>XHTML Source</web-resource-name>
<description/>
<url-pattern>*.xhtml</url-pattern>
<http-method>..snip..</http-method>
</web-resource-collection>
</security-constraint>
-Gianni

Answer 1

I don't think you can,
the XHTML pages will always be saved to the browser, you can prevent caching, you can use some encoding to encrypt them and javascript to prevent right click - but it would still be possible to view source - but you can make it difficult.