clicking a link after session timeout showed login page xhtml code instead of a rendered jsf page

we had a weird error today. we saw that after our session timed out and then we clicked on something in our application, we were redirected to the login page, but we were able to see the jsf code in the browser, instead of seeing the login form.

we found out that the problem was in our web.xml.

here's the relevant code:

<servlet-mapping>
<servlet-name>Faces Servlet</servlet-name>
<url-pattern>*.jsf</url-pattern>
</servlet-mapping>
...
<error-page>
<error-code>403</error-code>
<location>/login.xhtml</location>
</error-page>

to fix the problem we changed it to this:

<servlet-mapping>
<servlet-name>Faces Servlet</servlet-name>
<url-pattern>*.jsf</url-pattern>
</servlet-mapping>
...
<error-page>
<error-code>403</error-code>
<location>/login.jsf</location>
</error-page>