configure jetty to exit on error
ant jetty.run: add param jetty.port in build.properties + use "/" contextpath + anonymize webApp name
pom.xml: use esup-smsu-api 2.0.0
replace jetty-servlets CrossOriginFilter with simplified one which do handle spring beans

the original version is great but only allow FilterConfig hence no spring beans :-(
in org.esupportail.smsu.web.CrossOriginFilter we added a setter for allowedOrigins

NB: another solution would have been to use servlet3: servletContext.addFilter(...).setInitParameter("allowedMethods", ....)
cleanup pom.xml: remove variable now used only once
cleanup: move UrlGenerator.java into smsu namespace to ease cherry-picks with esup-smsu
replace config vars tomcat.host+serviceURL with server.url+contextPath

- no need anymore to configure twice when behing a reverse proxy
- tomcat.host was a bad name, server.url is better
- add comments explaining what java-cas-client expect in case of reverse proxy
allow X-Impersonate-User HTTP header in cross-domain XHRs
add /WebWidget.js as alternative to /WebWidget for easy inclusion without reverse proxy

usage in a container: <script src="xxxx/WebWidget.js"></script>

uses great & easy pattern "HTML client-side include":

echo "document.write(" . json_encode(file_get_contents($html_file)) . ");";
WIP impersonate user
js: instead of using a global var "xhrRequestInvalidCsrfState", use a parameter flag

not sure it's better to handle 2 parrallel CSRF errors,
but the code is cleaner that way for next commit
if cookies are rejected, try passing sessionId in url (as expected by java servlets)

NB: also configuring CAS to not redirectAfterValidation since:
- it needs cookies
- it is useless for /rest/login which is a web service
js: specific error message in case of WS error 503
for server side templates, use {{serverSide.xxx}} instead of simply {{xxx}}

this will allow more powerful things and is clearer regarding angularjs
ease configuration: allow trailing "/" in property server.url & contextPath
implement service-side-xxx directives to handle css/js + cache busting (aka fingerprinting)

NB: the cacheBuster adds ?v=<timestamp> to urls, which is not best according to https://developers.google.com/speed/docs/best-practices/caching
    but it should be quite good for our needs (and better than nothing!!)
implement service-side-concat & service-side-angular-templates directives

it allows concat of js files + angularjs templates
cleanup: move important things first in config.sample.properties
config.sample.properties: modify default cas.url so that it shows clearly what's wrong in browser

with previous value, the browser it skipping the redirect to CAS alltogether, leading to weird errors.
at least with cas.univ.fr one will see the bad url in the browser
html: if fatal error, display a msg explaining what to fix