Enhance list_group_users in GroupApi.

If there is no member in the group.
When get the group users, the varible "member" is an empty dictionary.
It will crash at "member[self.member_attribute]".
This commit add a judgment to determine the member is empty or not.

Closes-Bug: #1259426
Change-Id: Ic20549204bcc35f71464b858f5ca900a4bbfe049
Cleanup of new credential_api delete methods

Based upon the feedback on the credential_api.delete_credentials_for_user
and credential_api.delete_credentials_for_project implementations, apply
some cleaner default logic and comments/docstrings.

Change-Id: I6d1abe71931bce82c122d6cce9a94beccd8ffcfb
bp: assignment-controller-first-class
Do not update password when updating grants in Assignment KVS

Assignment KVS backend no longer performs an update that causes
the user's password to be updated when updating grants. This
potentially would have caused any/all grant updates to set the
user's password to the current password hash, effectively making
it impossible to login with the user. The longer-term fix
should ensure that the backend does not need to update the user
itself from the driver level.

Change-Id: I74ffc643020fa077c39a0cf16847e397a0c24139
Closes-bug: #1265887
Move deletion business logic out of controllers

Based upon the feedback on the credential_api deletion changes,
the deletion code should be moved down to the managers from the
controllers. This means the business logic to delete / modify
associated resources based upon a given action no longer resides
in the controller. The changes include (but are not limited to)
mass token deletion (delete_tokens_for_(user|trust|project|domain),
domain content deletion, credential deletion, etc.

This change also moves around the use of @dependency decorator
to ensure the *_api managers are added to the correct objects.

The token_api has been expanded to handle the token revocations
for users, projects, and domains directly (public methods). This
allows the managers to handle deletions rather than the
logic residing in the controllers; it was previously not clean
to issue a `delete_tokens_for_user` outside of the controller.

A few minor test changes and additions were needed to handle the
moving of business logic. Notably, the keystoneclient tests
(test_keystoneclient) CompatTestCase needs to setup SQL for the
credential_api to be able to perform delete logic.

bp: assignment-controller-first-class
Change-Id: I721e49258c10830b3c44f301e8c9e5f954262388
Break dependency of base V3Controller on V2Controller

With the cleanup that has occured, it is now possible to make the
V3Controller to stand on its own with out needing to inherit from
the V2Controller. To accomodate this change, `_require_attribute`
has been moved from V2Controller to keystone.common.wsgi.Application.

Change-Id: Id5cd5384a100a5d3de6beac2ba445854a2e8e6fd
bp: assignment-controller-first-class
Remove 'disable user' logic from _delete_domain_contents

Bug 1130236 has been marked as completed and fix released. This
commit removes the logic in `_delete_domain_contents` that disabled
the users prior to cleaning up the contents of the domain due to the
bug.

Change-Id: I0b1fba429cf45baae88a629e1629ce704dad4246
Merge "Enhance list_group_users in GroupApi."
Merge "Cleanup of new credential_api delete methods"
Merge "Do not update password when updating grants in Assignment KVS"
Merge "Move deletion business logic out of controllers"
Merge "Break dependency of base V3Controller on V2Controller"
Merge "Remove 'disable user' logic from _delete_domain_contents"