Fixup imports after rebase on v1.2.5
Avoid unauthorized popup upon 401 response for AJAX request
Allow to remove disgusting "throws Throwable"

They're too ugly to live, and are only there because of programmer's
laziness. Bite the bullet and get rid of them.
Allow application programmers to call into Security guts

it is desirable to expose some of Security "internals" in order to
modify the rendering based on rights or authentication. This is nicer
than to let the application depend on 1 specific implementation.