Status Message is vulnerable to reflected XSS

This fixed #1148

Outcome:
1. status message is not communicated through URL anymore, instead they're through session in the server.
2. thus, hacker cannot touch status msg in the URL. (GOOD)
3. and the status message will disappear when user refreshes the browser, since status msg is removed in session after displayed. (GOOD)
3. but session function need to be turned on in appengine-web.xml. Just in case, its performance in GAE need to be monitored if we finally choose to use session. But I guess it'll be fine, as session's a quite common feature. (UNSURE)
4. some test cases need to be updated, since some developers use appending msg param in URL to test the status message..

Idea:
1. Previously, status msg communicating through URL is because class RedirectResult uses this way to send its status msg to class ShowPageResult. E.g., instructor deletes a student, the status msg is created in studentDelete action, and in its RedirectResult after it's executed, this msg is appended in URL; then when comes to CoursePage (redirected), its ShowPageResult get the msg from request's parameters (as it's appended in URL), and at the end the msg got from param is saved to request's attribute and displayed in StatusMessage.jsp.
2. If there's only ShowPageResult created, it doesn't need the status message appended in URL. E.g. when eroll students successfully, the status message is displayed directly and URL doesn't contain any message parameteres.
3. But then sending msg through URL is vulnerable, as hacker can easily modify it in the browser and possibly can attack any users.

My solution:
1. For class RedirectResult to communicate with ShowPageResult, I use session to store the msg, and load it when it finally comes to ShowPageResult; after it can be displayed, then the msg in the session is removed and thus it cannot be displayed for the second time. Patch is simple and within 30 loc
Add appengine-web.template.xml

this fixed #1148
refactor the patch
make dev green for my own UI test

since instructorFeedbackResultsPageAction doesn't touch status message,
contentTest with status message is removed
rename function putStatusMessageToRequest -> addStatusMessageToRequest
Merge pull request #2109 from TEAMMATES/Issue1148

Status Message is vulnerable to reflected XSS #1148