Do not support toggling key_manglers in cache layer

Due to needing to pass the PKI token (complete id) to the backend,
the cache layer needs to ensure that the cache-key is always
shortened down to a reasonable length. Disabling the key_mangler
should only have ever been done in limited debug configurations.
Real deployments would be unable to reliably run without the
key mangler (due to cache-key length on most systems being
exceeded by the Token calls).

This change of ID being passed around is for supporting
non-persistent tokens.

DocImpact: configuration.rst updated to reflect the change in
           configuration options for keystone cache layer.
bp: non-persistent-tokens

Change-Id: Ia4eb3df7ccffa58ee867120f698e24d926f0ec9e
Fix OAuth1 to not JSON-encode create access token response

The OAuth1 response was a JSON-encoded urlencoded string rather
than just a urlencoded string as expected.

This also enhances keystone.middleware.wsgi.render_response() to
support setting the Content-Type header in the response.

Closes-Bug: #1336910

Change-Id: I72dcb61cae712c3c76382d2d6067b4f5fad7729d
Updated from global requirements

Change-Id: I302b2ba8b4d608d689cadbf8e5b4bd29764465e3
Merge "Fix OAuth1 to not JSON-encode create access token response"
Merge "Do not support toggling key_manglers in cache layer"
Add _BaseFederationExtension class

_BaseFederationExtension class with general use methods should be added
so inheriting classes don't need to reimplement such methods

Change-Id: Ic2d8e8e96b8b16d60071f8a7fb9eeeb3d688dcb8
Fix assignment LDAP backend tests
Merge branch 'master' of https://github.com/openstack/keystone into hierarchical-projects-base