SAK-21624

Commit of a partial solution.  This adds server side code that does
a HEAD request to the URL if popup is not selected.  If the URL returns
an X-Frame-Options header, the tool switches to popup automatically.

This is controlled by a property:

iframe.xframe.timeout=7200000

This sets the number of milliseconds between checks for a
particular placement.  The default is to check every two hours.

This can be disabled by

iframe.xframe.timeout=-1

This *works* quite nicely for any site that actually yields its
X-Frame-Options when a server sends a GET/HEAD.  But some servers
(Facebook in particular) do not send back an X-Frame-Options
header when Java connects to it.

So this works nicely with http://www.google.com/ and still silently
fails for http://www.facebook.com.

This will need to be augmented with some JavaScript code as
described by Matt to catch those sites that only return X-Frame-Options
when they think they are talking to a browser.

But this is pretty slick for sites like Google that give us the
header in a server-to-server call.




git-svn-id: https://source.sakaiproject.org/svn/web/trunk@120164 66ffb92e-73f9-0310-93c1-f5514f145a0a