Bulk deletes run by periodic clean ups might fail when run for the first
time or after and there are a lot of documents accumulated

Lists of documents for deletion are now partitioned into sub lists with
a maximum of 500 elements using Google Guava.

Stagemonitor and its dependencies are no longer included in builds. To
enable Stagemonitor in production, the libraries must be provided by the
host system. Additionally, the Java Servlet container needs to be setup
to load these additional dependencies for the web app.

For Tomcat 8 this is done by setting up a context config file in
conf/Catalina/localhost/<context path>.xml with the following content:

    <Context>
      <Resources className="org.apache.catalina.webresources.StandardRoot">
        <JarResources className="org.apache.catalina.webresources.DirResourceSet"
            base="<path to Stagemonitor JARs>"
            webAppMount="/WEB-INF/lib">
        </JarResources>
      </Resources>
    </Context>

See https://tomcat.apache.org/tomcat-8.0-doc/config/resources.html for
more configuration options.

Questions and answers of affected sessions are now deleted.

Lists of visited sessions for guest users which have not been active for
a fixed amount of time are now automatically deleted.

The cleanup is now disabled by default and can be set up by uncommenting
the configuration parameter `session.guest-session.cleanup-days`.

This reverts commit 3e969181.

This reverts commit 5f5699c5.

The backend wrongly trusted user input allowing the circumvention of
access control checks.