Authorization refactoring

Addresses https://www.pivotaltracker.com/story/show/66946122

Rename FedoraPolicyEnforcementPoint interface to FedoraAuthorizationDelegate.
Instead of passing principals to PEP/authorization delegates, pass the session instance.
User and group principals added as session attributes.
ServletContainerAuthenticationProvider adds the servlet request as a session attribute (so authorization classes can access request IP address, etc).
Changed FedoraUserSecurityContext constructor to take a Principal instance rather than ServletCredentials.
Added additional documentation for PEP/authz delegate and other methods.