Amy and Charles,
Thank you for your suggestions!
Charles, changing the permissions on the WEB-INF dir didn't work
!["" "[Frown]"]("frown.gif")
I tried that before posting.
Amy, your suggestion was on target. I created a photos dir underneath WEB-INF vs using the images dir, since I don't want the graphics designer to accidentally overwrite the photos people upload.
Yes I am using JSPs.
Also, I did e-mail Kelvin and this was his response:
"Yes it is, the WEB-INF is protect by Resin and it won't allow any http requests from it."
- Matt