LPS-37055

Hi @rotty3000 

here is pull for additional checks so that we add tokens only when really needed. For this I did some refactors so that the code is cleaner.

Short summary of the most important changes:
* I centralized whitelists logic into AuthTokenWhitelist (old PortletSecurity class) - it makes better sense
* I encapsulated token verification logic only into AuthToken (SessionAuthToken)
* I fixed PortletURL to add tokens only when the portletId/strutsAction is not whitelisted + other special cases (portlet isn't on the target page)
* I fixed SessionAuthToken to save tokens into session only when really needed

I tested it and it should work (including adding auth.token.ignore* from a Hook).