#19 eliminate session/request pollution

[Max Cooper]

Currently, SecurityFilter stores various user account and
request processing items as attributes in the request and
session.

Some or all of this information may be moved to data
structures that are "private" to SecurityFilter, reducing
pollution in the request and session scopes, and possibly
improving security.

Session items can be keyed off the session ID, and a
listener could be added to remove data for expired
sessions. Something similar may be possible for request
information. Request informaion could be removed after the
chain.doFilter() call returns.