fix maxSessionIdleTimeout setter
Rename the NotificationHandler to NotificationReceiver to leave 'Handler' for the actual HTTPHandlers.
Refactoring of the BasicAuthenticationMechanism now that the need for an inner class to handle the actual authentication has been removed.
It is not really possible to make a generalisation regarding the cachability of a successful authentication directly from the mechanism, instead caching mechanisms can be added for a number of different reasons.
Update the ClientCertAuthenticationMechanism to remove the additional method that was a left over from using an inner class for authentication.
Add a new handler that is responsible for registering a Collection of NotificationReceiver instances with the current SecurityContext.
Add support for failure notifications within the security framework and update the individual mechanisms to report the failures.

(Includes test case updates to verify the expected notifications are sent)
Add the ability to pass in NotificationReceiver instances during the servlet deployment process.
Change the way the session cookie configuration works
Session changes for clustering