Further enhancements to the form-based auth scheme

These changes add support for proper redirect behaviour on login and access denied to the host page,
including the passing of extra request parameters which is especially important when attempting to
log in in GWT Dev Mode.

This commit also includes enhancements that we've contributed to PicketLink. These enhancements
should appear in PicketLink 6.0.0.CR2, due out on April 25. We can remove the types in the 'tmp'
package once that release is out.