Core: try out Jersey Container Filters (#293).

Just an experiment. Nothing useful for the moment.

See ticket 293.
Core: try out Servlet Filters (#293).

Just an experiment. Nothing useful for the moment.

See ticket 293.
Core: new setting dm4.installation.type (#293).

There are 4 DeepaMehta installation types (left column):

{{{
                    Net Interface       Read                Write
------------------------------------------------------------------------
SINGLE-USER         localhost           yes                 yes
(default)

PRIVATE             all                 if logged in        if logged in

PUBLIC              all                 yes                 if logged in

SANDBOX             all                 yes                 yes
}}}

See ticket 293.
Extend Access Control service by login() (#293).

See ticket 293.
Access Control: fix cyclic dependency (#293).

The request filter is setup by the Access Control plugin (instead by DM4 Core).

Changed in Access Control service:
    - login() renamed to checkCredentials()
    - getUsername() has no parameter anymore ("clientState" is dropped)
    - getTopicPermissions() has no "clientState" parameter anymore

Furthermore in DM4 Core: a plugin can register a (Servlet API) filter by calling
    - registerFilter(Filter filter)     // declared in plugin base class

See ticket 293.
Parent POM: update version from 2 to 3.

Because of these changes:

Dependency management:
    - Neo4j MehtaGraph 0.9 -> 1.0
    - new dependency: Felix HTTP API 2.2.0
Bundle plugin configuration:
    - Default bundle activator is de.deepamehta.core.osgi.PluginActivator
Access Control: create HTTP sessions (#293).

For a logged in user a HTTP session is created.
The dm4_username cookie is not used anymore.

Furthermore in Webclient: the API method require_login() is removed.

See ticket 293.
Access Control: logout (#293).

Once logged out the HTTP session is invalidated.

Changes in Access Control service:
    - logout() is added
    - lookupUserAccount() is dropped

See ticket 293.
Access Control: drop "installation type" (#293).

Instead the "dm4.installation.type" config property there are 2 separate boolean properties in global pom.xml:
    - dm4.security.read_requires_login      # default is "false"
    - dm4.security.write_requires_login     # default is "true"

See ticket 293.
Access Control: logout shuts down client (#293).

When logging out from a "private" DM installation the webclient shuts down, that is the browser window is emptied. This reflects the meaning of a "private" installation: the webclient is only accessible when logged in.

A DM installation is made "private" by setting the config property dm4.security.read_requires_login to true (in global pom.xml):
{{{
    <dm4.security.read_requires_login>true</dm4.security.read_requires_login>
}}}

Note this drawback: the next request logs in the user automatically. This is a known problem with HTTP Basic authentication.

See ticket 293.
Access Control: global subnet filter (#293).

The subnet filter of the Files plugin is moved to the Access Control plugin.
The subnet check is applied to *every* request (not just file requests).

There is a new config property in global pom.xml:
{{{
    <dm4.security.subnet_filter>127.0.0.1/32</dm4.security.subnet_filter>
}}}

The former dm4.filerepo.netfilter property is dropped.

See ticket 293.