Moved HTTP date formatter into WebUtilities
Improvement to candidate session launch workflow

I have moved the candidate session entry to a separate step after the
session is first instantiated. This allows an additional page to be
presented to the candidate which uses some JS to invoke the
entry/re-entry into the session. Candidates using the back button
will end up back at this page, which automatically pushes them back
into the session again.

Needs a bit of tidying, which will be in the next few commits
Change to item session URL path

For symmetry with test session URL namings, we are now using
'itemsession' instead of just 'session'.

(This change will not affect any existing sessions. These URLs are
transient during candidate operations.)
Minor reorganisation of CandidatePrivilege enum
Tidied up the new session launch JSP
Minor tweak to session entry logic edge case

We now do nothing if the session has been terminated. The next step
in the web workflow is rendering, which then renders the appropriate
"this assessment is now closed" page to the candidate.
Change to session exit URL handling

These are now sanitised when passed from LTI launches.
Only HTTP/HTTPS URIs are allowed. Anything else will be ignored
and logged.

The existing sanitisation at final redirect time has been removed.
Filled in missing JavaDoc for this class
Improved handling of unresolved RP templates

The ItemSessionController was previously expecting RP templates to
always resolve successfully, resulting in an IllegalStateException if
that wasn't the case. I've added a guard for this and now log a runtime
warning when this happens. (Note that the validation process does test
for this.)
Updated to Spring 3.2.6
Ready for 1.0-beta4