SEC-2276: Delay saving CsrfToken until token is accessed

This also removed the CsrfToken from the response headers to prevent the
token from being saved. If user's wish to return the CsrfToken in the
response headers, they should use the CsrfToken found on the request.
SEC-2280: Fix SessionFixationConfigurer#changeSessionId Javadoc

The Javadoc for SessionFixationConfigurer#changeSessionId() was copied and pasted from
SessionFixationConfigurer#none() and never updated. It is incorrect. This commit fixes that.
SEC-2103: Change log of no results to debug
SEC-2103: Fix tests to verify debug logging instead of info
SEC-2146: Document AspectJ does not inherit annotations
SEC-2171: Include Information about pooling in Spring LDAP documentation
SEC-2131: Update doc to state session authentication sends 401 if no page
SEC-2229: spring-security-web dependency polish

- remove direct dependency on spring-aop
- spring-tx and spring-jdbc optional
SEC-2129: AntPathRequestMatcher also supports case sensitive comparisions
SEC-2282: Add CSRF documentation to the reference manual
SEC-2229: Add optional dependencies to spring-security-config

spring-tx and spring-jdbc aren't pulled in transitively from
spring-security-web now, so we must include them as optional dependencies.
SEC-2286: Log invalid CSRF tokens at debug level
SEC-2272: CsrfRequestDataValueProcessor support Spring 4 and Spring 3
SEC-2289: Make compatible with Spring 4 as well

There are a few subtle changes in Spring 4 that this commit addresses
SEC-2289: Add spring4Test
SEC-2282: Polish CSRF doc
SEC-2285: Added headers to to reference
SEC-2291: Fix internal links within reference

Instead of using xlink:href="# use linkend="
SEC-2283: Update headers documentation and tests
Tweak PermGen for tests