push realm implementations together to avoid casting from
RestletUtilSesameRealm that should only be used in OAS
add note about replacing secret comparison function with one that uses
hashes instead