fixed user selection bug (should use currentUser() call instead of
direct field access)
clients have trouble with understanding multiple Accept headers so try
to merge an existing one (if present)
treat responses with a SoapAction as ECP-responses. Spring-security uses
text/xml as Content-Type