Add ToadletContext.checkFormPassword(HTTPRequest). Check the form
password for POST requests in ToadletContext before passing control
to the Toadlet.
Merge remote-tracking branch 'vwoodzell/form-password' into form-password
(Still under discussion)
Allow toadlets to opt out of automatic form password checking on POSTs.
Avoid timing vulnerability in ToadletContextImpl.checkFormPassword(HTTPRequest).
Merge remote-tracking branch 'vwoodzell/form-password' into form-password
Merge branch 'stable-1448-new' into form-password
Redirect to the right place - usually this is toadlet.path().
allowPOSTWithoutPassword is unnecessary here. That doesn't mean it will never be necessary, it's still useful.
Only allow Library and plugins for now
Plugins handle their own FormPassword checking, this is how it's been for a while.
Factor out hasFormPassword(), useful for some plugins/toadlets for confirmation page.