tools: Don't include valgrind.h

It was updated upstream, but more importantly we don't need it.
The Makefile.am stuff prevents us accidentally running phantomjs
under valgrind anyway.

Closes #1222
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
test: Allow phantomjs to be in $PATH

For example phantomjs may be installed in your homedir. It should
still be in the path, but not necessarily in /usr/bin

Closes #1227
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
selinux: session PAM stack wants to communicate with systemd via socket

Symptom:

audit: type=1400 audit(1411115120.035:21): avc:  denied  { sendto } for  pid=1176
	comm="cockpit-session" path="socket:[18680]" dev="sockfs" ino=18680
	scontext=system_u:system_r:cockpit_session_t:s0
	tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket
	permissive=0

Closes #1224
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
configure: Link appropriate binaries to krb5 libraries
common: Utility function for decoding hex strings

And tests
ws: Implement basic GSSAPI kerberos authentication

The actual authentication happens in cockpit-session, which has
access to the keytab
ws: Implement basic testing of kerberos auth during 'make check'

This requires the 'krb5-server' package or similar to be installed
while running 'make check'
static: Try an SSO login before showing the login form

This allows kerberos (ie: Negotiate, GSSAPI) SSO authentication to
happen before showing a login form.

Fixes #57
static: Don't use single sign-in if user explicitly logged out

When the user explicitly logged out, don't try and use single
sign in to authenticate. Otherwise the user would just be logged
in again.

There are two use cases here:

 * The user wants to finish the session and log out
 * The user wants to log in as someone else

So we force display of the login form in the case where logout
was explicitly used.
ws: Send WWW-Authenticate: Negotiate header for any auth failure
ws: Test kerberos against host@COCKPIT keytab credentials

This is how it is used with Active Directory, and not necessarily
with HTTP specific kerberos SPN.
ws: If we can't resolve a real local name, use fully qualified

Use fully qualified kerberos user name if we cannot resolve it
into a valid local user via the kerberos routines.
test: Check negotiate authentication
selinux: cockpit-session uses GSSAPI which wants to write to tmpdir

GSSAPI writes to a replay cache. cockpit-session now uses GSSAPI
and needs to be able to write, read, delete from tmpdir

Symptom:

cockpit-session: gssapi auth failed: Unspecified GSS failure.
	Minor code may provide more information (Cannot create replay
	cache file /var/tmp/HTTP_0: File exists)
HACKING: Add instructions for how to configure SSO

This is a bit convoluted currently, but it's important to make this
reproducable and for people to be able to develop against it ... or
it will never ever get better.

Closes #1124
session: Refactor the writing of auth responses back to cockpit-ws

Make it so we can more easily compose messages and optionally
include fields of various types.
session: If we receive delegated creds send them back to cockpit-ws

When we receive delegated credentials, send them back to cockpit-ws
so that it can use them to authenticate against other machines.
ws: Provide a place in CockpitCreds to store GSSAPI creds

The GSSAPI creds represent a kerberos ccache (ie: one with a kerberos
ticket). We decode this on demand when needed.
ws: Use GSSAPI creds to authenticate via SSH

When we have GSSAPI creds, use them to authenticate via SSH if
the peer server requests such authentication.
ws: When cockpit-session sends creds use/store them

Closes #1226