Adding a configurable AllowedMethodsFilter

By default this allows GET, POST, PUT, DELETE, HEAD, and OPTIONS. In other words, TRACE and CONNECT are blocked. This is enabled on both the application servlet and admin servlet.