UP-4106 Enforce CONFIG permission.

Addresses CVE-2014-3417 :relieved:  .

This is the same fix as that on `rel-4.0-patches` ( https://github.com/Jasig/uPortal/commit/26aa4b4f2f5d1c3d95ad38b5bb9e68933c0da6d7 ) and included in uPortal `4.0.13.1` ( https://github.com/Jasig/uPortal/commit/de2acd1d613980d0540df8e2f7babf0e6281dc96 ) , tweaked to

* Use the Commons Lang 3 available in `master`
* Use the slf4j available in `master`
* Get the authorization exception name right in the `enforceConfigPermission` JavaDoc

Proffering as pull request against `master` so that this fix implementation, now that the cat's out of the bag, has an opportunity for review.  This should definitely be reviewed to merge before cutting 4.1 GA.