Change ListOpt default value from str or None to list

In keystone/common/config.py, some ListOpt config object was inited
with a string or None default value, it's incorrect. This patch modifies
their default value to list objects.

Change-Id: I2aec4f49d94e131d45f7dc9bfeb63b8d819d0bb1
Closes-Bug: #1259735
Resolve oauth dependency after paste pipeline is loaded

When trying to authenticate with the oauth plugin, it is
possible that the dependency is not yet loaded, and as a result
the user will receive an error message: "Oauth is disabled"

This patch will ensure the dependency is loaded after the pipeline

Fixes: bug #1264803

Change-Id: I37484bf844896b1a1b560923a8afaf99e91635e4
Tests use cleanUp rather than tearDown

The tests were putting clean-up code in tearDown. Using tearDown
causes problems with developing and testing because if there's an
exception raised in setUp then tearDown is not called and this
typically affects other tests. For example, you'll get several
tests failing because one test's setUp failed and now the other
tests can't load fixtures.

Also, this should make it easier to switch to using fixtures since
fixtures use cleanUp.

Change-Id: I0d0d14ec34ebbeb9dbf0fe2fe3dd304b868bcf93
Fix external auth (REMOTE_USER) plugin support

According to the WSGI specification "REMOTE_USER should be the string
username of the user, nothing more" [1], therefore no modifications
should be made to the REMOTE_USER variable and it should be fully
considered as the username. Otherwise the expected semantics of the
REMOTE_USER variable change, and an site administrator could get
undesirable side-effects.

[1] http://wsgi.readthedocs.org/en/latest/specifications/simple_authentication.html#specification

Moreover, it is important to have a consistent behaviour regarding
external authentication in V2 (not domain aware), V3 with default
domain and V3 with domain (see Bug #1253484) so that we produce similar
results with the three methods.

This change aims to solve this issues by removing the split of the
REMOTE_USER variable by "@" at all:

- In external.DefaultDomain, we cannot split REMOTE_USER by "@". This split
  will cause errors for remote users containing an "@" (not only
  emails, but also X.509 subjects, etc). The external.DefaultDomain plugin
  considers the REMOTE_USER variable as the username, and the configured
  default domain as the domain

- In external.Domain we should not split also the REMOTE_USER by "@". A
  new environment variable (REMOTE_DOMAIN) is introduced, so that any
  external plugin can pass down the right domain for the user. The
  external.Domain plugin considers the REMOTE_USER as the username, the
  REMOTE_DOMAIN as the domain if it is present, otherwise it takes the
  configured default domain.

- Two legacy plugins are also provided with the same behaviour as the
  Havana shipped ones. This plugins should not be used and are provided
  for compatibility reasons (see Bug #1254619)

Closes-Bug: #1254619
Closes-Bug: #1211233
Closes-Bug: #1253484

DocImpact: This change breaks backwards compatibility in favour of
security (see bug #1254619), therefore an upgrade not is needed. It is
needed to document the new plugins and state clearly the semantics of
the REMOTE_USER and REMOTE_DOMAIN variable for the WSGI filters. The
default external authentication plugin has been changed from
exernal.ExternalDefault to external.Default.

Change-Id: I1b2521a526fa976146dfe2fcf4d4c1851416d8ae
Merge "Change ListOpt default value from str or None to list"
Merge "Tests use cleanUp rather than tearDown"
Merge "Resolve oauth dependency after paste pipeline is loaded"
Merge "Fix external auth (REMOTE_USER) plugin support"