The implementation is MVC. The View is isolated to the browser layer. The Model is isolated to the persistence layer. The Controller is split with: UI controls in the browser mostly so input is syntacticly correct, authentication and authorization controls are in the listener layer (Tomcat and remote LDAP), and data integrity controls in the persistence layer (an RDBMS with stored procedures).
Question is, where should the business logic control go? It is defined by a data driven model in the persistence layer. So the code/logic could go in either the persistence layer itself via stored procedure, or in the listener layer via Java classes. If it is to be in the listener, additional work will need to be done to bring the data across layers.