make UserSession non static

UserSession is now an interface
the old UserSession has been split into ServerUserSession (implements the lazy loading of credentials directly from DAOs) and ThreadLocalUserSession (implements the thread local management)
add UserSessionRule for UserSession management in unit test with support for ServerTester
DoPrivileged now restores the user session which was in ThreadLocal before it ran
move MockUserSession to server.tester package