expose shiro.globalSessionTimeout, for some reason the default property configuration is not working
improve logging
tidy
add filter to strip out WWW-Authenticate headers in responses when request has "X-Requested-With: XMLHttpRequest" header to avoid browser BASIC auth dialogs.

Conflicts:
	components/nexus-webapp/src/main/java/org/sonatype/nexus/webapp/WebappModule.java
extract method from anonymous class for testing
notes
add basic sanity check of omission logic
tidy stupid default param name that annoys me
notes
Use user-agent instead of X-Requested-With to determine if WWW-Authenticate should be omitted

Conflicts:
	components/nexus-webapp/src/main/java/org/sonatype/nexus/webapp/WebappModule.java
notes
notes
bind ommision filter at high-rank
fix since