added very basic request locking again that prevents fetching the data holder from the request. this is, obviously, not 100% secure since you could just set it into an attribute or something prior to action execution, it's just to prevent very basic mistakes
moved action instance creation to allow per module autoloading of base actions
* Fixed Output Type detection everywhere (needs to call {{{$ot->getName()}}} now)
 * Changed Action and View method interfaces to expect an AgaviRequestDataHolder instead of an AgaviParameterHolder
 * Changed Sample app to comply with these changes
 * Implemented new recommendation to have base views and base actions in sample app (using a per-module autoload.xml)
fixed xmlrpcepiphp response and implemented 404 for xmlrpc
changed createExecutionContainer() signature to accept a string for the output type name instead of an output type instance
security filter creates exec containers from the current container now to keep output type intact. also, you can now either return an array or an execution container from the view to forward
no wait I changed my mind. only exec containers. objections?