Refactor the servlet filter logic to more generic web processors

This is the first pass of a pretty large change so I wanted to make it public here for a bit rather than just merge without oversight.

While this currently passes the integration tests, I have not fully exercised the demo site.  I imagine I will be making a few changes to this later on in the week but plan to merge this in by the end of the week.

The biggest change here is the setting of scope when setting request attributes:

```java
WebRequest request = new ServletWebRequest(httpRequest);
...
request.setAttribute('attrib', value, WebRequest.SCOPE_REQUEST);
```
is equivalent to:
```java
HttpServletRequest request = (HttpServletRequest)servletRequest;
...
request.setAttribute('attrib', value);
```

Also note that there doesn't need to be any null-checking for getting session attributes as that is already handled automatically.  You shouldn't ever really need to create a session when getting session attributes; only setting.  Therefore, this call:
```java
WebRequest request = new ServletWebRequest(httpRequest);
...
request.getAttribute('attrib', WebRequest.SCOPE_GLOBAL_SESSION);
```
will *never* create a session (just returns null if there is no session) whereas this call:
```java
WebRequest request = new ServletWebRequest(httpRequest);
...
request.setAttribute('attrib', value, WebRequest.SCOPE_GLOBAL_SESSION);
```
will *always* create a session.

Let me know of problems or concerns.