[FIX SECURITY-170] Don't expose parameters not defined on the run

Backporting concurrentHashMapSerialization test removal from #2071, as it prevents use of JDK 8 to run core tests.

[SECURITY-266] Conceal ciphertext from users who could not resubmit it here

[SECURITY-243] Prefer id to fullName

Make it possible to disable SecurityRealm.loadUserByUsername call with a system property if it proves too slow in certain circumstances.

[FIX SECURITY-276] Don't allow open redirect using scheme-rel. URL

[SECURITY-281] Forbid /computer/(master)/config.xml

[SECURITY-281] Demonstrating that GetNodeCommand and UpdateNodeCommand refuse to operate on Jenkins itself.

Unclear if, say, LDAPSecurityRealm ever throws this.

[FIX SECURITY-273] Require admin permission to check update sites

[FIX SECURITY-250] Restrict access to admin APIs

In the case the user is valid but not saved the user need to be created.
This catches the case where the user has not saved anything and is using
their default API token.

Fix a couple more calls and add a pointer to Jenkins.getUser()