If you can test some parts of the server-side code in isolation (without using HTTP), you are free to do so.
However, it will be difficult for some parts of the application (pieces that interact with HttpServletRequest, HttpServletResponse, or JSPs).
If you have some complex part of the application such as an algorithm, which is independent of a Web application context (e.g. the algorithm might also be useful on a desktop application), then you are allowed to test it with JUnit directly.
Eric