[JENKINS-23665] Parameter to select alias of SSL/TLS certificate for
Jenkins Web UI, private key password
In case the KeyStore password and the KeyPassword are not the same, the
KeyManagerFactory needs the KeyPassword because it will access the
individual key(s)
Backward compatibility in case httpsPrivateKeyPassword is not set at all
Add support for setting the Jetty requestHeaderSize and requestBufferSize which can impact the maximum URL size and/or affect the processing of POST requests
allow for sane logging behind a reverse proxy

Allow the use of headers for logging that are related
to reverse proxy setups:
* X-Forwarded-For
* X-Forwarded-Host
* X-Forwarded-Proto
* X-Forwarded-Protocol
* X-Forwarded-Server
* X-Forwarded-Ssl
* X-Requested-With
* X-Do-Not-Track
* DNT
* Via

Introducing a new logger format alias 'rproxycombined'
consisting of the X-Forwarded-For header + the COMBINED alias.
Merge pull request #16 from TorstenS73/master

[FIXED JENKINS-23665] Parameter to select alias ...
Merge pull request #17 from stephenc/requestHeaderSize

Add support for setting the Jetty requestHeaderSize and requestBufferSiz...
Merge pull request #18 from jdsn/reverseproxylog

allow for sane logging behind a reverse proxy
Just delegate to JDK for handling chained exceptions
Bug fix in the pull request.

It was ignoring the self-signed cert case
[maven-release-plugin] prepare release winstone-2.4
[maven-release-plugin] prepare for next development iteration
Set the version number that Jetty understands

This show up in log as well as the HTTP 'Server' header
[maven-release-plugin] prepare release winstone-2.5
[maven-release-plugin] prepare for next development iteration
[JENKINS-22358]

Do not put session ID in the URL, which is like asking for the session
hijacking attack.

While it is unclear how JENKINS-22358 happens when several reporters
claim they have not disabled cookies, the failure mode clearly indicates
the session ID is added to the URL, so disabling that altogether at the
container level should resolve the problem.

With this change, if the cookie is not enabled, a login will succeed
but one can never login, because as soon as the user logs in, the
browser promptly forgets that session and will appear as a new user.

In the future perhaps it would be desirable to detect the browser that
doesn't support cookie, and warn the user accordingly.
[maven-release-plugin] prepare release winstone-2.6
[maven-release-plugin] prepare for next development iteration
[FIXED JENKINS-25169] Because of the POODLE vulnerability, we disabled SSLv3 by default.
Merge branch 'master' of github.com:jenkinsci/winstone