[FIXED JENKINS-16397] Just displaying /asynchPeople constructed the expensive People object merely to decide whether or not to display the “REST API” link.

This change does not necessarily improve total performance, since the avatar is still computed.
But (1) the computation is correctly done in the work thread, not in the HTTP response thread;
(2) the computation is done just once for a given User, which could reduce load when many AJAX checks are done.

The actual change is in the remoting 1.20.

Reworked UnprotectedRootAction display to be in configure page for better discoverability and possibility of support from reverse-proxy-auth-plugin.

Implementation according to Jesse Glick's comments on the issue.

[FIXED JENKINS-15889] Saving the update center list after the metadata has been fetched results in the metadata being persisted twice

now it is done properly on Javascript side so the current server
implementation triggers javascript errors.

Result can be observed on DynamicComboBox within ui-samples-plugin