Refactor default security engine

Refactor the default security engine to add token based authentication.  This allows for
a token to be constructed which can authenticate a Principal for a given amount of time.

These tokens make use of CryptoCookie which allows the token to be verified as being
issued by this application and how long it is valid for.

The default security engine implementation is refactored to take care of most of the
authentication logic, specific implementations should override:

 * protected Principal doPasswordLogin(String username, char[] password) throws BalsaSecurityException
 * protected Principal principalForToken(byte[] token)
 * protected byte[] tokenForPrincipal(Principal principal)
 * protected String getMetricsIntelligenceSourceName()