Which J2EE web development framework to choose for a simple, accessible application?

Question

I want to write a simple web application, on J2EE, with these characteristics:

1. I don't need any AJAX, and it should even work with JavaScript disabled on the browser.
2. It is a simple CRUD application
3. I would need full control on the way each element is laid out on the page - no compromise on the GUI's look and feel.
4. I can use plain old JDBC for data access - no o/r mappers necessary
5. Bookmarking of pages is necessary (wherever it makes sense to bookmark, that is).
6. Many of my users use tabbed browsing very much.

What I'd like the framework to do is:

1. Give me a nice abstraction to retrieve GET and POST parameters
2. Give me a nice facility to display validation errors and other errors to the user
3. Give a set of standard safety features - prevent cross-site scripting, prevent the user from setting a dropdown input to a value that isn't there in the dropdown, et.al
4. Be performant, scale well for over 200 concurrent users, on a not-so-powerful server. (no clusters - single node, a shared app server with multiple production applications)
5. Be stable; because I'd like to have that application running without a major refactor for at least 3-4 years

I looked at a few frameworks, and this is what I felt..

1. Plain Servlets/JSP - I need to code everything myself - this would take time, and probably have many bugs
2. Struts (1.x) - Doesn't provide too many advantages over the plain servlet approach; while it does map POST and GET parameters to form beans, the other features I'm looking for aren't there; and I need to invest a lot of time coding them myself
3. JSF - I'm scared of it because of the performance problem I've read about. It seems like the view construction and maintenance takes up too much memory. Also, JSF won't work well with bookmarks and tabbed browsers.
4. Tapestry - I took a look at Tapestry 5. While it looked good, it too seemed to be incompatible with tabbed browsing and bookmarking. While there is certainly support for "activation context", it is only a single string. It can't restore the state with GET parameters and hidden form fields (yet). Additionally, there seemed to be concern about the longevity of the framework - it appeared that it evolves without backward compatibility.
5. Apache Turbine - It looked good at first; but the fact that it's quite old and there's no much activity going on scares me.

Any suggestions on what would be good for me? Thank you!

PS: I'm constrained to use one that's licensed under Apache license (v2, preferably) or BSD license

Answer 1

Spring-MVC is another option to consider