Password protection: you should read about security within JSP and servlet, there are four types of security, which can be declared in web.xml. See the specification or J2EE tutorial on Sun site.
Session is configured per web app and only configuration is <session-timeout>. You should handle session in your code.