[FIXED SECURITY-200] - Do not expose Api tokens to other users by default

[SECURITY-195] - Prevent the folder escaping

[SECURITY-184] check secret-key in handshake

System property can be used to restore the original behavior

[FIXED SECURITY-192] - Require Jenkins.READ permissions to access CLI pages

[SECURITY-173] use XMLUtils safe transformation to create a job from xml

[SECURITY-177] Reflected XSS in AdjunctManager.doDynamic

Added a test case to cover bases

Conflicts:
	test/src/test/java/hudson/model/UserTest.java

[SECURITY-171] XSS in FormValidation._error(..., Throwable, ...)

[SECURITY-180] arbitrary API Token change/leak via changeToken

Add nosniff header liberally to every request we serve.

With the server-side download, the test needs to induce the update
center metadata retrieval in a separate manner.

Conflicts:
	pom.xml