add session manager and cache krb auth
    
    This patch adds a session manager and support for caching
    authentication in the session. Major elements of the patch are:
    
    * Add a session manager to support cookie based sessions which
      stores session data in a memcached entry.
    
    * Add ipalib/krb_utils.py which contains functions to parse ccache
      names, format principals, format KRB timestamps, and a KRB_CCache
      class which reads ccache entry and allows one to extract information
      such as the principal, credentials, credential timestamps, etc.
    
    * Move krb constants defined in ipalib/rpc.py to ipa_krb_utils.py so
      that all kerberos items are co-located.
    
    * Modify javascript in ipa.js so that the IPA.command() RPC call
      checks for authentication needed error response and if it receives
      it sends a GET request to /ipa/login URL to refresh credentials.
    
    * Add session_auth_duration config item to constants.py, used to
      configure how long a session remains valid.
    
    * Add parse_time_duration utility to ipalib/util.py. Used to parse the
      session_auth_duration config item.
    
    * Update the default.conf.5 man page to document session_auth_duration
      config item (also added documentation for log_manager config items
      which had been inadvertantly omitted from a previous commit).
    
    * Add SessionError object to ipalib/errors.py
    
    * Move Kerberos protection in Apache config from /ipa to /ipa/xml and
      /ipa/login
    
    * Add SessionCCache class to session.py to manage temporary Kerberos
      ccache file in effect for the duration of an RPC command.
    
    * Adds a krblogin plugin used to implement the /ipa/login
      handler. login handler sets the session expiration time, currently
      60 minutes or the expiration of the TGT, whichever is shorter. It
      also copies the ccache provied by mod_auth_kerb into the session
      data.  The json handler will later extract and validate the ccache
      belonging to the session.
    
    * Refactored the WSGI handlers so that json and xlmrpc could have
      independent behavior, this also moves where create and destroy
      context occurs, now done in the individual handler rather than the
      parent class.
    
    * The json handler now looks up the session data, validates the ccache
      bound to the session, if it's expired replies with authenicated
      needed error.
    
    * Add documentation to session.py. Fully documents the entire process,
      got questions, read the doc.
    
    * Add exclusions to make-lint as needed.