Freeze v3

[Cantor, Scott]

Found a couple of late significant bugs and patched them.

I cleaned up a bunch of Spring config so that all our lists of strings in 
properties are unquoted and comma-delimited like they should be.

V2 upgrade findings
- out of the box, you do get a low level Spring error message and it's 
very noisy when it can't find the LDAP server cert, but it does say 
FileNotFound at the bottom of the mess
- sticking a dummy cert there gets to the login page and switches it to 
the Pool error
- tested my V2 config with both Kerberos and JAAS authn back-ends
- lowered some logging, I'm sure that will be ongoing, typical first 
release stuff

I just put the proposed default RP config in (and put a test resource in 
for the tests), and I went ahead and enabled the attribute-release flow. 
We should have discussed that question on the call, but I thought we had 
been expecting to go ahead and do that, just to get it in front of people. 
In practice, putting it in the default RP probably isn't a likely choice 
for most sites at least here, but it's illustrative and easy to shut off.

I think we also intended to leave it working uApprove style without the 
per-attribute release on, so that's defaulting off.

I'm about done for the night. If there's anything feeling wrong or we need 
to discuss, I'll be around tomorrow afternoon and evening.

-- Scott