More correct usage of HTTP verbs

Most notably, don't allow GETs on unsafe methods
Use ExtJS jQuery adapter instead of ext-base

Now that we're finally using jQuery, the adapter makes a lot of things
easier. For example, you can set global jQuery Ajax event handlers that
will run even if you use Ext.Ajax.request.
CSRF prevention

This upgrades to Spring Security 3.2 RC1. Yes, it's a release candidate,
but the API is pretty stable, and it's the only way to get native CSRF
token support.

Note that X-Frame-Options is set to DENY by default. If you're using
OpenEssence in a frame, you'll have to do some (small) tweaks.
Disable CSRF tokens for API clients

As a compromise, API clients must set their User-Agent to be
`openessence-api-client`.
Convert logback.xml to Groovy

This fixes the issue where Logback would generate a
catalina.base_IS_UNDEFINED directory if Tomcat wasn't running. This
would happen, e.g., in unit tests.
Delete ReportAppender

We haven't used it in years (it's been broken). It also doesn't
actually log reports.
Merge pull request #24 from gabegorelick/logback-groovy

Logback groovy
Merge pull request #23 from gabegorelick/csrf

CSRF prevention