Unfortunately for you, the classes need to be exposed to the web interface so they are available to the remote client. This means it needs to be available in the WAR, otherwise from the servlet container, or if you have a front-end web server, from that.
These are in some measure for security as you do not want to expose other directories in your application server, particularly those with data or libraries in them.
That is what I thought. I wanted to make sure though. Thank you.