Added MutableServletContextHandler.

Because we don't know ahead of time if we'll need a security manager or a session manager.
Use MutableServletContextHandlers.

And enable/disable security and sessions appropriately.
Pass the server to the session and security managers.
Improve JsonProcessingExceptionMapperTest.

Switch it to a JerseyTest so we're actually testing what we care about.
Merge remote-tracking branch 'upstream/master'