Passes the user session through to subclasses that implement the role-based permission callback.

- This is needed for the XACML delegate, for instance.

Relates to: https://www.pivotaltracker.com/story/show/70771806
Generalize suppression of PROTECTED properties

- Add a test for those defined by mix:lockable
- Suppress version-related properties

Resolves: https://www.pivotaltracker.com/story/show/71266232
declare dependency on commons-lang
update Modeshape to 3.7.4.Final
Create BOMs for fcrepo-jcr and fcrepo4

Resolves: https://www.pivotaltracker.com/story/show/63571456
Prevent reference properties pointing at literals

Resolves: https://www.pivotaltracker.com/story/show/71279532