Trying to port "External" login handler

[Cantor, Scott]

One concern I have right now with the RemoteUser option I built is that
because the login flows run as subflows, the URL stays the same, so
triggering the container to do a login would happen up front before the
profile starts, instead of mid-stream like before (there's no AuthnEngine
URL to protect).

I'm reviving the possibility of having something like the External handler
today, and trying to branch out of the webflow and then back in.

It took more hours than I'd like, but I have something primitive working
and I was able to resume the flow from what I can see, by using a
view-state that uses an externalRedirect as the view.

I'm still struggling with state passing in and out, but if nothing else
works, session attributes would, and we're already dependent on the Java
session for SWF to work anyway. I was hoping to use request attributes,
particularly on the way back in, because I could provide compatibility to
some extent with the original interface, and even expose constants with
the same package names like Rod did for scripts.

Anyway, if I can make this work, we probably won't end up using the
RemoteUser extraction flow I built, and we'd just ship a sample "External"
handler JSP that does that job for people.

-- Scott