Security provider

sorry but I'm still working out how to use github.

This second pull request contains the logger updates as does the first request so it will be easier to just accept this one and ignore the first.

The pull contains:
a security provider which removes the requirement for using the servlet supplied user principle.
You can now provide a security principle via a servlet init-param. I've provided a default implementation that falls back to the original servlet based user principle.
The second change is moving the 'root' init-param into the FileSystemStore as this was specific to that store type. I've also change the ctor on the store to expect a ServletConfig so now any store can get additional init info from the servlet if required.