Added MutableServletContextHandler.

Because we don't know ahead of time if we'll need a security manager or a session manager.
Use MutableServletContextHandlers.

And enable/disable security and sessions appropriately.
Pass the server to the session and security managers.