Opening stable/havana

Change-Id: Iba0fd89063cd0b09a8cc62373368c834ba604571
Fix remove role assignment adds role using LDAP assignment

When using the LDAP assignment backend, attempting to remove a
role assignment when the role hadn't been used before would
actually add the role assignment and would not return a
404 Not Found like the SQL backend.

This change makes it so that when attempt to remove a role that
wasn't assigned then 404 Not Found is returned.

Closes-Bug: #1242855
Change-Id: I28ccd26cc4bb1a241d0363d0ab52d2c11410e8b3
(cherry picked from commit c6800ca1ac984c879e75826df6694d6199444ea0)
(cherry picked from commit b17e7bec768bd53d3977352486378698a3db3cfa)
Fix Rootdir determination

This is a partial backport of I15c1707eb6a62c74a0021a48b89ae15f03fcfea8

Change-Id: Ia4c490e2e2cd0851bb378f1db4116a955a6ad845
Fixes-Bug: #1241198
Update memcache to match global requirements for stable/havana

python-memcache prior to version 1.48 will leak memory due to always
caching cas ids (compare and set) and with nothing designed to clean
it up.  In 1.48 it was changed to require a boolean argument 'cache_cas'
on init to enable the cas id caching.  In the case of keystone, we rely
on the cache_cas argument and cas functionality.  Ideally, all uses of
memcache should use later than 1.47 to prevent the memory leaking of
cas id caching.

Change-Id: I656a70a70342745d77dc285e338a0430852e8e0a
Merge "Fix Rootdir determination" into stable/havana
Fix issues handling trust tokens via ec2tokens API

Trust scoped tokens are handled incorectly when making requests
via the ec2tokens API, meaning that the restrictions enforced
by trust-scoped tokens are not respected when obtaining a token
via ec2token signature validation.

Storing the trust_id in the blob associated with the ec2 keypair,
and passing that id in the metadata when requesting a v2 token
solves the issue.

Change-Id: I52566384d7813ef0e2f20fb94a5076386457ff02
Closes-Bug: #1242597
Updated from global requirements

Change-Id: I26478513314d619d73aff9874757e7c57c6a15b9
Merge "Fix issues handling trust tokens via ec2tokens API" into stable/havana
remove runtime dep on python-pbr
sync parameter values with keystone-dist.conf