Adding an ExceptionMapper for AccessDeniedExceptions.

Motivation:
When a resource requires authorization and is accessed by a user that is
not logged in an EJBException will be throw with a "caused by" exception
of type AccessDeniedException. This is all good an well and the returned
HTTP response status will be 401 Unauthorized. But in the case where
CORS is in use that response will lack the correct CORS headers leading
to a 404 Not Found to be reported by the browser.

Modifications:
Adding a JAX-RS ExceptionMapper provider which will inspect the type of
exception and if its of type AccessDeniedException will send a 401
Unauthorized response, and if the request was a CORS request set the
appropriate headers.

Result:
After this change a javascript client can check the response status and
take action when a protected resource is accessed when the caller is not
logged in and display/redire to a login page.