[FIXED JENKINS-16278] Fixed RememberMe cookie signature generation (bugfix on SECURITY-49)
Thanks

At this time the target project is unset so it has no known type and we just have to assume the threshold is valid.

First, display instructions when the user has CONNECT, not necessarily ADMINISTER.
Second, when anonymous users cannot CONNECT, show how to use -jnlpCredentials
(and do not bother showing javaws, since it does not work in this case).

 [FIXED JENKINS-16215] Avoiding unnecessary downloads in FilePath.installIfNecessaryFrom

Use 'duck-typing' approach for detecting test mojos

A user running 1.467 reported:
java.lang.NullPointerException
    at hudson.model.RunMap.load(RunMap.java:216)

[FIXED JENKINS-16397] Just displaying /asynchPeople constructed the expensive People object merely to decide whether or not to display the “REST API” link.

at least interning some heavily redundant strings."

This reverts commit 08efdf5d.

Conflicts:

	changelog.html

[JENKINS-16341] INSANE testing shows that a RenderOnDemandClosure binding adds about 380k, with or wothout 08efdf5d.

New cookie signature generation was not implemented in creation of RememberMe cookie, but only in its verification.
Fixed by new override TokenBasedRememberMeServices2.loginSuccess

Make sure that change log annotation cannot result into exception

This change does not necessarily improve total performance, since the avatar is still computed.
But (1) the computation is correctly done in the work thread, not in the HTTP response thread;
(2) the computation is done just once for a given User, which could reduce load when many AJAX checks are done.