libapr alone is not sufficiant. libtcnative is required for Tomcat.

Removed X-Forwarded header handling from the application code and
documented how to setup the servlet container and reverse proxy to
handle those.

The link property of Facebook Oauth profiles no longer has a consistent
value across logins and will be completly removed in future versions of
Facebook's Graph API.

We generate a link in the old format from the id for backwards
compatibility.

Fix CouchDB query keys for PI answer stats

See merge request !86

Only enable full CORS config if a domain is specified

See merge request !85

The public CORS config was always overriden by the more generic config.
Credentials are no longer allowed to be sent with default CORS config.

Set role for admin users

See merge request !84

Setting 'security.cors.origins' did not have any effect since the the
configuration was overriden by the default path settings.