include jsp-api and servlet-api in lib instead of relying on tomcat
being installed
JavaScriptServlet - set the content type on output
use Javascript to inject token into form actions

This is in addition to appending the token into the form as a hidden
element. This partially solves the issues of multipart uploads since the
token will now be available to request.getParameter(). This also means
that there's no need to parse through the multipart upload request.
allow user to specify a list of HTTP methods to protect

This change allows the user to specify a delimited list of HTTP methods
that should be protected. This should be used only when the user has
concrete knowledge that all requests made via methods not in the list
are safe (i.e. do not apply an action to any data).

If the configuration property is unset then the old (protect all methods)
behavior is retained. This should be used with the understanding that
security vulnerabilities could actually be introduced by using this
feature if for example the user thinks that all actionable requests are
only available by POST requests when in fact some are available via GET
requests. If the user has excluded GET requests from the list then they
have introduced a vulnerability.
Merge remote branch 'esheri3/master'
Package a sources jar too
Redirects should only be protected if the HTTP GET method is protected
bump build number
Update test app to use latest features of the filter
Comment out the rest of the multipart upload stuff
clean up the filterConfig when we get destroyed
respond to sendRedirect immediately instead of delaying to the end of the filter chain

At least in Tomcat 6/7 the response object's PrintWriter stream is
closed after a call to response.sendRedirect(). This caused an
IllegalStateException to be thrown (and subsequently swallowed) and a
200 OK response with no content to get sent back to the client.

This was due to the fact that the InterceptRedirectResponse class only
kept a reference to the location of the redirect and processed the
actual redirect after the filter chain was complete. However, by this
time the wrapped response was already in a commited stated (and its
output stream closed).

This fix changes the interceptor to process the sendRedirect call
immediately. This means we can still inject the token into the redirect
URL and we don't have to delay the response.

Additionally, we only process a redirect if the HTTP GET method is
protected. If GET is unprotected there's no sense appending a token to
the URL.
update test app jar
bump version number
no need to checkin the dist jar for the webapp

should be using the ant deploy task to do this
Merge pull request #14 from ReadyTalk/master

Several updates - immediate redirect, only protect redirect if GET is protected, etc.
TokenPerPagePrecreate for creating tokens in advance.
Fixed NPE and trim() issues with protected methods property parsing.

TokenPerPagePrecreate allows use of per page token on first access,
rather then using session token on first access. It only works in
conjunction with JSTL tags and is designed mainly for better back
button support. Default value is false(off).
IE6 caching JavascriptServlet response
changed email address
changed email addresses all around