making Behaviour.applySubtree to consider the given node itself as a possible match. Previously it wasn't.

adjuncts are like static resources, and they should be available without read access, or else page rendering can fail

- md is not concurrency safe, so the whole thing needs to be synchronized or we need a pool, like ThreadLocal
- There's a convenience method that creates hex string