Access Control module: fix logout (#423).

Logout works for "private" DM installations too.

As a reminder:
The webclient of a "private" DM installation is only be visible/usable when logged in. The browser brings up its own login dialog *before* the DM Webclient actually appears. And once logged out, the Webclient GUI disappears and leaves a blank browser window.
A DM installation is made "private" by setting the `dm4.security.read_requires_login` config property to `true`. See
    pom.xml (Development setup)
    /conf/config.properties (Standard Distribution)
    /etc/system.properties (Karaf Distribution)
By default the Standard Distribution sets up "non-private" DM installation.
By default the Karaf Distribution sets up a "private" DM installation.

To fight the "HTTP logout" problem in conjunction with a "private" DM installation the following workaround is now utilized: a /accesscontrol/logout request replies with 401 Authorization Required. This emulates a HTTP logout by forcing the webbrowser to bring up its login dialog. This time the login dialog is pure dummy (it can't be used to login again). The login dialog just forces the browser to forget the former Authorization information. The user is supposed to press "Cancel". The webclient shuts down the GUI then and the browser window just shows "You're logged out now".

At the moment the login dialog appears the user is actually logged out already (the session is invalidated), so it is safe to close the browser window immediately, without pressing "Cancel".

In the browser's error console the 401 response is reported as an error. This can safely be ignored.

The dummy login dialog appears at least in Firefox and Chrome. However, in Safari (tested with 5.1.7 as of Mac OS X 10.6.8 Snow Leopard) the dummy login dialog does *not* appear. Apparently Safari suppresses the login dialog when the 401 is a result of an AJAX request.

Conclusion: with Safari logging out from a "private" DM installation works perfectly fine (besides a 401 error is reported). With Firefox and Chrome the possibility of a true HTTP logout comes at the price of a dummy login dialog. With a "non-private" DM installation logout is no problem at all.

This ticket is regarded as resolved.

BREAKING CHANGE

Access Control API:
    - logout() (resp. /accesscontrol/logout) returns void (instead of boolean).
      For a "private" DM installation the response is 401 Authorization Required.

See ticket 423.