deleted encoding-less variant of readFirstLine according to https://github.com/jenkinsci/jenkins/commit/4ee8d6890c354e67daeb5f55806c16f6986b32c3#core/src/main/java/hudson/util/IOUtils.java-P13

To be really correct, the crumb API call should be using the encoding specified in the HTTP response header, but doing so involves various header parsing, which is cumbersome.

Since we know Jenkins always serve the API call in UTF-8 encoding, here I'm baking that assumption in.

allow advanced users to tweak this value, as someone reported in IRC that '@' in token is problematic for his environment.

removed unused imports; fixed some generics warnings; added note about current XStream's StringConverter behaviour

honored correctly.

... by extending from AbstractPasswordBasedSecurityRealm.

plugins can be properly controlled by per-project matrix security.

See issues like JENKINS-6888.