User can exclude headers (generally in responses is most useful)
by configuring them, or calling a setter in ZuulProperties.

If Spring Security is on the classpath we add a few headers
automatically, corresponding to the ones that would be added
by Spring Security in the remote backend anyway (so they are not
added twice). Nothing is actually removed, so if the remote
service doesn't add those headers, we don't change anything.

The X-Application-Context header is also added to the hard coded
list of ignored headers, because it isn't relevant in the
gateway (and leaks information about the remote service).

Fixes gh-819

Plus polish

fixes gh-836

Fixes gh-803 (again)

Otherwise there can be duplicate beans with the same type and different
names, becasue the autoconfig does not (for some reason) use
@EnableConfigurationProperties to create the ServerProperties bean.

It isn't an issue until someone writes some autoconfig that itself
imports the ZuulConfiguration (i.e. regular concious users of
@EnableZuulServer do not see any problems and hence no tests fail
here or in integration projects).

Fixes gh-821

I.e. show empty "foo" as foo (not foo=)

Fixes gh-825

fixes gh-822

fixes gh-406

fixes gh-813

fixes gh-809

Upgrading feign

Also does not rename another one because it fails (see gh-804). The
bug can be fixed in feign (https://github.com/Netflix/feign/pull/324),
and if that gets merged and released we can revert some of the recent
changes to the apache load balancer here.

fixes gh-807

See https://github.com/spring-cloud/spring-cloud-build/issues/26

Fix typo: zule-core -> zuul-core.

* spectator-issue-264:
  fix registration bug in SpectatorMetricServices

The primary change is to fix a memory leak reported in
Netflix/spectator#264. Each time a gauge was updated it
was creating a new registration and because the map holds
a strong reference these would never get collected.
Further, the aggregate value created by the multiple
registrations was not correct.

In addition I added some test cases around the various
inputs and checked that the results were reflected as
expected in the registry. I noticed the timer values
had a unit of milliseconds, but it isn't immediately
clear if the reported value can ever less than 1.0. The
conversion to long is now delayed until after converting
to nanoseconds so duration values less than 1.0 will now
work instead of just recording 0.

For the histogram I changed to just using a cast to `long`
to avoid boxing to a `Double`. As an FYI for the future,
there is a DoubleDistributionSummary we have experimented
with in spectator-ext-sandbox that might be more appropriate
for this use-case.

It is up to the user to configure a mapper if needed (one is no
longer provided automatically), so it doesn't need to take up
space in ZuulProperties

Fixes gh-803

So that it isn't instantated eagerly on startup by the RefreshScope.

Fixes gh-789

Tests are very sensitive to the Zuul RequestContext which is
thread bound.