Insert server-side delegates for remote resources

This branch deals with a issue we hit in the integration workshop: we found that we couldn't run a test installation without putting all the pieces on the same machine, which was _really_ restrictive. (The issue is browsers' CORS protection, and working around it is non-trivial in general.) The fix this proposes is to put a simple servlet that delegates some URLs to others; the browser doesn't see that the resource is at another site, so it all works smoothly.

I've also implemented a mechanism that makes the credentials to be used with the remote sites be kept on the server and never communicated to the client. While the Plan Management GUI _can_ be secured with a username and password (and indeed is in my deployment of it because I'm a little bit paranoid!) that's completely independent of what is required to access anything else.