Failfast / don't fail starting

[Rod Widdowson]

> For automatic re-loads of configuration, my view is that if the new
> configuration does not load, then it should revert to the last good
> configuration.

That’s absolutely the design for the spring loading.  For logback reload (an
edge case I know but it’s the one which occupied yesterday) it doesn't
appear (more investigation needed) to be possible.  

Instead we ship with a fallback configuration (in the jar) and revert to
that if the logging has an error.    I actually added the code to log the
absence of a fallback configuration (and not NPE) yesterday.

> I don't think we need complicate life by making it possible to configure
> non-fail-fast behavior without reloading, and yet have somebody expect it
> will reload.

> I think no-reload means no-reload, so maybe log a suggestion to turn
> on reloading to deal with the faulty config.

Oh good.  Then we agree, it seemed like a recipe for byzantine code and
difficult to explain behavior, but I wanted to check that no one else
expected it.

So I'm assuming that we will introduce an idp.failfast property into our
configs.  We can argue about the default later, but the feeling is that we
may want to swap to failfast=false.

Rod