Thread safety

This is to improve thread safety for static methods that may be called from multiple threads.
This change does not affect the thread safety of individual HttpRequest instances.

Use ThreadLocal for trustedFactory, as the documentation for the classes used makes no thread-
safety guarantees.
Make TRUSTED_VERIFIER final and initialize lazily using the lazy initialization holder class
idiom used in Effective Java item 71, as the implementation used is thread-safe.
Make connectionFactory volatile.  This requires implementers of the ConnectionFactory interface
to ensure that their implementation is thread-safe.

This also changes the static members used that were not final to use the more conventional
camelCase naming rather than ALL_CAPS.