Initial implementation of PEP

Resolves https://www.pivotaltracker.com/story/show/55891634

- Prevented Session.save() when RepositoryExceptions are thrown (was in finally block)
- Made all REST API sessions, with or without client login, use ServletCredentials to obtain a ModeShape session
** This is so that we can use the same PEP injection for anonymous clients as we do for logged in users.
- Created a bypass servlet authentication provider, for REST testing w/o auth
- Made all REST calls use servlet credentials
- Added fcrepo-auth-commons to fcrepo4
- Renamed SessionFactory.getSession() methods w/o credentials to getInternalSession(), such that use is clear to devs
- Tied the transaction ID to the servlet session, to prevent duplicate login (now that use consistently use servlet credentials at REST endpoints)