Java EE (Java Enterprise Edition) General Discussion

I use following java codes to prevent cache and unauthenticated access in my jsp file:
...
<%
response.setHeader("Cache-Control", "no-cache");
response.setHeader("Cache-Control","no-store" );
response.setDateHeader("Expires", 0);
response.setHeader("Pragma", "no-cache");
if (session.getAttribute("User") == null)
response.sendRedirect("./index.jsp");
%>
...

But if I use the same code in xhtml file I got error that xhtml doesn't support such codes.

Any solution?