If the web app is not unit-tested, it's probably also not easily unit-testable. Putting it under unit-tests can be risky as you do not have [Unit] tests, yes, chicken and eggs. Moreover this takes time and doesn't bring much value to the application.
I'd aim to write end-to-end automatic test with Selenium, Watir, HtmlUnit, or HttpUnit, YMMV for the legacy part of your application. These tests (characterization tests) will pin down your current application behavior, like unit tests do, but from the outside, allowing you to make changes with the ability to detect undesired side effects.
Write unit tests for the new code, and when changing the legacy code, whether it is for fixing a problem, or adding new capabilities.
