added shib servlets to web-security so that ShibLogin is invoked (and shib user created if necessary) before shib servlets have to add shib user to lesson class; refactored ShibExportPortfolioServlet to extend ShibLearnerServlet; moved xdoclet out of .java files because it doesn't work properly with a servlet extending another servlet