Casc 200 rebasefail

This pull request works on CASC-200.  Please ignore the previous pull request (I'll close it) as I accidentally re-based a remote branch which you cannot do and in the process made additional changes :-(

This introduces a few things:
1. Configuration strategies
2. Configuration keys
3. a simple Protocol enum to separate protocol stuff from configuration

I realized there are a few javadocs I need to fix.
Basically passing it at the authentication filter requires you to do it at the validation layer.  Not enforcing it on both filters means that someone could subvert the attempt (since you could remove it from /login to re-use your existing TGT and the client would not know unless it confirmed it via validate)