REP-1272 HERP Filter

I don't know if this is done or if it's even ready for a PR to be opened, but I want to get more eyes on it.

Also, I'll almost certainly be handing the remaining work off.
Should we just add a timestamp to each request as a servlet request attribute? It seems cleaner and safer than adding/checking a header. I would think that the container would have a way of providing a timestamp, but I can't find anything to support that.