Limit calls to memcache backend as user token index increases in size

This eliminates the need to do a get on each token in the user's index
on token issuance. This change will change the maximum number of tokens
that can be outstanding for a given user. This change is two-fold, first
instead of using JSON to store the token IDs, the python list structure
is being stored in memcached; second the expiry for the token is also
stored in the list. The net result is that fewer tokens can be stored
in the user's token index list due to an increase in data being stored
per token in the index page.

The new logic will attempt to upgrade the old json-style lists to
the new format of [(token_id, expiry), ...] stored as a native
python object in the memcache backend. This conversion will keep
any outstanding tokens in the list from (<time_of_conversion> +
<configured expiration of tokens>). This is done to ensure that
tokens can still be invalidated by operations that invalidate
tokens based upon user/project/trust/etc changes without causing
potential lockups in keystone trying to retrieve all of the
actual token expiration times from memcache.

Closes-bug: #1251123
Change-Id: Ida39b4699ed6c568609a5121573fc3be5c4ab2f4
Bump stable/havana next version to 2013.2.3

Change-Id: Ia5b940faf01df6cae58df1f4b4f5e8fa2f3f078a
Fix list_projects_for_endpoint failed bug

list_projects_for_endpoint fails with "500 Internal Server Error".
Modified the function name to 'list_projects_for_endpoint' and
added three test cases.

Change-Id: Ibe86dd4fb845004d4ebce359de034f31bd50ecc9
Closes-Bug: #1269703
(cherry picked from commit 2f7fa55bd046b5e0ec7b7c2bad8c88c7f33d0c9e)
Ensure tokens are added to both Trustor and Trustee indexes

Tokens are now added to both the Trustor and Trustee user-token-index
so that bulk token revocations (e.g. password change) of the trustee
will work as expected. This is a backport of the basic code that was
used in the Icehouse-vintage Dogpile Token KVS backend that resolves
this issue by merging the handling of memcache and KVS backends into
the same logic.

Change-Id: I3e19e4a8fc1e11cef6db51d364e80061e97befa7
Closes-Bug: #1260080
SQLAlchemy Change to support more strict dialect checking

Update a couple DELETE operations within the test_sql_upgrade test
case to support the more strict dialect checking that occurs in
0.9.3 of SQLAlchemy for "additional arguments".

Closes-Bug: #1286717
Change-Id: I82b57257a8b49d798d813c65e76757021676ba90
Merge "Ensure tokens are added to both Trustor and Trustee indexes" into stable/havana
Fix issue deleting ec2-credentials as non-admin user

The ec2tokens controller incorrectly uses the access id, not the
hashed credential id in _assert_owner, which means that non-admin
users can't delete their ec2-credentials.  Adding the hashing, as
in _get_credentials fixes the problem.  Test added demonstrating
the issue.

Change-Id: Ifb6e3e10a50541cf21d25880bd74e9aeb6df4f26
Closes-Bug: #1245435
(cherry picked from commit 85ca6ac8a7fab14c659673ddf47777badcbcbf04)
Merge "Fix list_projects_for_endpoint failed bug" into stable/havana
User a more accurate max_delay for reconnects

In an HA deployment, a 60 seconds delay between reconnects can be quite
problematic. This patch changes the delay calculation by setting the max
delay to 5s and by changing the way it is increased.

Unfortunately, this is one of the places where both our main drivers are
not consistent. Rabbit's driver uses configuration parameters for this
whereas qpid's driver has never had one. However, I would prefer not
adding configuration paremeters to qpid's driver for the following
reasons:

    1. Most of OpenStack services depend on the messaging layer, hence
    they need it to be available. A 5s delay seems to be reasonable and
    I could argue the need of tune it further. Although so frequent
    reconnects can add load to the network, that wouldn't be the main
    issue if one of the brokers go down.
    2. We're trying to move away from configuration options towards using
    transport URL. This path is still not clear and I would
    prefer avoiding adding new options until we clear it out.

Closes-bug: #1281148

Change-Id: I537015f452eb770acba41fdedfe221628f52a920
(cherry picked from commit 8b628d1e024f787dbb93d508117d9148388c0590)
Modify User schema
oauth1 cloned to tfa, no further changes. ~Tim P (NON WORKING)
EC2 core taken instead, modified to do a very primitive authentication as just a hello-world type exercise.
Working basic hello-world api. ayoung says work in auth. ~Tim Paine
A set of changes related to TFA; debugging needed
Modify default config
Update copyright date; register TFA contrib module
Update