439507 Avoid timing leak in MD5 compare

Also-by: Benny Baumann<BenBE@cacert.org>
439438 DataSourceLoginService does not refresh passwords when changed in database
439067 Javadoc for graceful server stop
439066 javadoc setStopAtShutdown
438327 Remove hard coded Allow from OPTIONS *
436987 limited range of default acceptors and selectors
435653 encode async dispatched requestURI
434536 Improved Customizer javadoc
439753 ConstraintSecurityHandler has dead code for processing constraints
439369 Deprecate CrossContextPseudoSession
Updated NPN and ALPN to JDK 7u65 and 8u11.
439672  support using Apache commons daemon for managing Jetty

Signed-off-by: marko asplund <marko.asplund@gmail.com>
439507 - Possible timing side-channel when comparing MD5-Credentials

+ Using correct digestMismatch logic
+ Fixing test cases:
  + No longer reuses / shares directories
  + Is now Windows build/test compatible
  + No longer deleteOnExit() the test data
    (let maven clean and/or test init do that)
  + Empty directories are now verified
  + Using server.getURI() instead of URL string manipulation
432815 Fixed selector stop race
434536 Improved Customizer javadoc
Adding dstest manual creation, not letting derby create it
Better cleanup of LoginService tests
Work with derby internal caching of "derby.system.home" system property.

+ Turns out, changing "derby.system.home" is unreliable.
+ Using 'directory' based jdbc urls for derby to avoid finding content
  in the classloader too.
+ Use a common derby "System Home" for all tests.
+ Segregate all database creation into own, test-specific, database.
Merge remote-tracking branch 'origin/master' into jetty-http2