SEC-1875: ConcurrentSessionControlStrategy no longer adds/removes the session to the SessionRegistry twice

This fixes two issues introduced by SEC-1229

 * SessionRegistry.registerNewSession is invoked twice

 * SessionRegistry.removeSession is invoked twice (once by the
ConcurrentSessionControlStrategy#onSessionChange and once by
SessionRegistryImpl#onApplicationEvent). This is not nearly
as problematic since the interface states that implementations
should be handle removing the session twice. However, as removing
twice requires an unnecessary database hit we should only remove
sessions once.
.gitignore src/*/java/META-INF/
SEC-1968: AbstractPreAuthenticatedProcessingFilter clears SecurityContext on null principal change with invalidateSessionOnPrincipalChange = true
SEC-1965: DefaultWebSecurityExpressionHandler is now passive from 3.0.x releases

There were two issues that needed resolved

 - Since DefaultWebSecurityExpressionHandler no longer implemented WebSecurityExpressionHandler a bean lookup by
   type would not work. This caused failures in the JSF support.

 - The method createEvaluationContext needed to be explicitly defined on WebSecurityExpressionHandler since the
   parameterized type from the super interface is not preserved at compile time. Without explicitly defining the
   method any class compiled against a previous version would cause a NoSuchMethodException.
SEC-1985: Removed WebSecurityExpessionHandler from reference
Use powermock for testing servlet 3.0 functionality instead of distinct classpaths
SEC-1906: Update to Gradle 1.0
SEC-1981: Remove dependency on Locale for the build
SEC-1907: Exclude crypto dependency in core module since classes are bundled in core
SEC-1990: Clean up jBCrypt and include its tests.

Merge in changes from jBCrypt.
- Use a ByteArrayOutputStream to cache bytes.
- Pass a StringBuilder into encode_base64.
- Refactor string comparison into its own method.
- General clean up.
SEC-1990: Polishing code cleanup on BCrypt

 - Formatting
 - Renamed test to be BCryptTests to better align with Spring Security's naming conventions
SEC-1906: Fix EmmaPlugin for Gradle 1.0
SEC-1992: Updated Spring version to 3.0.7
Set to 3.1.1 Release
Updated to next snapshot version
SEC-1994: explicit sourceCompatibility and targetCompatibility of 1.5 in Gradle build
SEC-1976: include *.aj files in sourceJar
SEC-1980: Prevent parser warning when URL's in configuration start with #

Previously a warning would be logged to the parser when a URL was
configured with a SpEL expression. These changes prevent warnings from
being logged when using SpEL for URL configuration.
SEC-1988: Add contributor guide link to readme.txt
SEC-1905: Added footnote to password encoding for digest authentication

Technically digest authentication can allow for encoded passwords, but
it needs to be in the correct format. This update adds a footnote to clarify this.

Previously the documentation stated that passwords must be in clear text.