Shiro Authentication Changes

After much poking around I think I have got it.

In short as we use Spring all the Shiro config needs to be in the XML files. Ours is in security.xml.

I have:
* Set the session timeout to 4 hours
* Enabled Shiro sessions
* Put in ehcache.xml and XML config with shiro
* Put lots of debug messages in the UmsRealm.java
* Added more shiro annotation / spring config we seem to miss