Add TimeoutResponseInvalidator

Invalidates ResponseFutureNotifiers after a given timeout.
Fixes #52
Rewrote ApplicationSecurityManager

Instead of handling Collection<String[]>'s the new
ApplicationSecurityManager uses StackTraceElementMatchers whcih are
used to inspect the current stack trace.
It's a bit more restrictive, but I don't think we need more for now
(but see #55).
Also fixes #51, but it's more of a hack (assumes no other packages than
java.* and sun.* are used by the class loader creation and that those
packages can be considered secure).