Fix #105

* configured tags can access request.attributes with simple expression vars (id)
* response is no longer available as a value for expressions; but there’s no use case
  for that anyway
* update docs
@ddeboer well, SensioFRameworkExtraBundle is inconsistent. For ``@Security``, you get more stuff, like the request.

@dbu the behavior for ``@Security`` is that known params always win. this way, you always know that ``request`` is the Request object. If you have a request attribute with the same name, you can always get it from the Request object.