Changed *Var backing store to concurrent hashmap
Fix deadlock in SoftReferenceCache apply function.

When we find a stale SoftReference, release the read lock, then acquire
the write lock, double-check that the reference is still stale, and then
finally remove the entry from the cache.
Move uriSuffix extraction into lift_ajaxHandler.

By having it in doAjaxCycle, there were situations where the uri suffix
could get lost. The most obvious one was when a long-running ajax
request was occurring, and two AJAX requests were queued during that
time frame. This would result in the first request getting the second
request's uriSuffix, and the second request getting no suffix at all.

We now immediately put the uriSuffix into the sending data when
lift_ajaxHandler is called.
Encode an AJAX request version in the request URI.

The AJAX request version has two components: the actual version number
and a count of queued requests. This is presented as two base-36 values
after a dash. So a request now looks like:

/ajax_request/F<page version>-v8

Where v indicates request number 31 and 8 indicates that there are 8
queued requests that have not been handled yet.
Drop the timeout on comet-related AJAX requests.

While this will tie up a request thread for longer, it means we can
reliably say that when the AJAX request thread completes, it will
actually have the correct response to the original request.
Add tracking for AJAX requests in LiftSession.

Request info consists of three things:
 - The request version.
 - A future for the response to the request, satisfied by the first
   request for this version when the response is ready.
 - A lastSeen timestamp, used to expire the entry after the usual
   function lifespan.

LiftSession.withAjaxRequests exposes the request list, which is a Map
mapping a page version to the list of AjaxRequestInfos currently being
tracked for that page. AjaxRequestInfos are cleaned up according to
their lastSeen timestamp, which is updated the same way as those of
functions on the page.
Implement the meat of AJAX deduplication.

AJAX requests now come in with a two-part version number, one a sequence
number for the ajax request's count in the overall list of requests sent
by the client, and one a number indicating how many other requests are
queued up on the client.

If this is the first request seen with its sequence number, we record
the request in the session and run regular AJAX request handling. When
that request handling is complete, it satisfies the future that is
recorded in the session. Subsequent requests for a given sequence number
wait on the future from the first request up to the ajax post timeout,
then fail.

When we get a request coming in with a 0 count for pending requests on
the client, we clear out all other pending requests in the session's
list, since that means none of them will be getting a chance to report
their responses again.
Track sequence numbers of arbitrary length.

We track sequence numbers as Longs now, and the client side encodes the
sequence number as an arbitrarily-long base-36 number.
Guard for JS number size overflows.

If you hit the maximum of a JS integer, math starts getting wonky. We
make sure at that point we wrap to 0.
Make AjaxRequestInfo track a Long version id.

Not sure how I got this to compile locally without this change...
Added a method to release all the long polling connections
Fix off-by one when escaping control char in JSON
Do not escape unnecessarily ranges which JSON spec does not require. Fix memoization
Fixed #1330 - HTTP basic authentication not working in 2.5

we lost an important "else" in LiftServlet - (Thanks to Aditya Vishwakarma for pointing it out)
Use ThreadLocalRandom in StringHelpers.randomString on Java 7.

On Java <7, we use the default SecureRandom, which locks on access.
ThreadLocalRandom will not lock as it is thread-local (!).
2.10.0-{M7->RC1}