add session resource

creates actual shiro sessions and saves them to the database
remove mrbean module, it conflicts with jersey
token based authentication

support authentication via session id, access tokens or username/password
allow creating access tokens for a user
do not create a session automatically (this needs work to figure out when not to create sessions, or maybe we always want them for security audits tbd)
no longer accepts a SHA-256 hashed password via username/password auth (this needs a change in the web interface)
Merge branch '020' into authtokens
Merge branch '020' into authtokens
implement session usage for web interface login

the web interface will now use session ids exclusively
sessions reads are cached in the server now (to prevent multiple loading of sessions in one request)
Merge branch '020' into authtokens
support return and parameter types in api browser

using jackson-json-schema and proper mapping of models, the api browser now can display the actual schemas in parameters and return values.
you need to use the jackson annotations for the types to make it work, though
remove sha-256 hash from api-browser password field

fix authorization lookup for admin user
sync users from ldap on login

update ldap settings when they change in the connector
hook up new ldap authenticator
try to figure out the email address of the ldap user
do not require a password for users anymore (coming from ldap we won't even store the hashed password anymore)
Merge branch '020' into authtokens
Merge branch '020' into authtokens
initial token api with docs

this needs cleanup
Merge branch '020' into authtokens
lower log level to debug