SEC-2098, SEC-2099: Fix build

- hf.doFilter is missing FilterChain argument
  - response.headers does not contain the exact values for the headers so
    should not be used for comparison (note it is a private member so this
    is acceptable)
  - hf does not need non-null check when hf.doFilter is invoked
  - some of the configurations are no longer valid (i.e. ALLOW-FROM
    requires strategy)
  - Some error messages needed updated (some could still use improvement)
  - No validation for missing header name or value
  - rebased off master / merged
  - nsa=frame-options-strategy id should use - not =
  - FramewOptionsHeaderFactory did not produce "ALLOW-FROM " prefix of origin
  - remove @Override on interface overrides to work with JDK5

web/src/main/java/org/springframework/security/web/headers/StaticHeaderFactory.java

@@ -3,6 +3,8 @@ package org.springframework.security.web.headers;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import org.springframework.util.Assert;
+
 /**
  * {@code HeaderFactory} implementation which returns the same {@code Header} instance.
  *
@@ -14,6 +16,9 @@ public class StaticHeaderFactory implements HeaderFactory {
     private final Header header;
 
     public StaticHeaderFactory(String name, String... values) {
+        Assert.hasText(name, "Header name is required");
+        Assert.notEmpty(values, "Header values cannot be null or empty");
+        Assert.noNullElements(values, "Header values cannot contain null values");
         header = new Header(name, values);
     }
 

web/src/main/java/org/springframework/security/web/headers/frameoptions/FrameOptionsHeaderFactory.java

@@ -33,11 +33,10 @@ public class FrameOptionsHeaderFactory implements HeaderFactory {
         this.allowFromStrategy=allowFromStrategy;
     }
 
-    @Override
     public Header create(HttpServletRequest request, HttpServletResponse response) {
         if (ALLOW_FROM.equals(mode)) {
             String value = allowFromStrategy.apply(request);
-            return new Header(FRAME_OPTIONS_HEADER, value);
+            return new Header(FRAME_OPTIONS_HEADER, ALLOW_FROM + " " + value);
         } else {
             return new Header(FRAME_OPTIONS_HEADER, mode);
         }

web/src/main/java/org/springframework/security/web/headers/frameoptions/NullAllowFromStrategy.java

@@ -10,7 +10,6 @@ import javax.servlet.http.HttpServletRequest;
  * To change this template use File | Settings | File Templates.
  */
 public class NullAllowFromStrategy implements AllowFromStrategy {
-    @Override
     public String apply(HttpServletRequest request) {
         return null;
     }

web/src/main/java/org/springframework/security/web/headers/frameoptions/RequestParameterAllowFromStrategy.java

@@ -24,7 +24,6 @@ public abstract class RequestParameterAllowFromStrategy implements AllowFromStra
     protected final Log log = LogFactory.getLog(getClass());
 
 
-    @Override
     public String apply(HttpServletRequest request) {
         String from = request.getParameter(parameter);
         if (log.isDebugEnabled()) {

web/src/main/java/org/springframework/security/web/headers/frameoptions/StaticAllowFromStrategy.java

@@ -14,7 +14,6 @@ public class StaticAllowFromStrategy implements AllowFromStrategy {
         this.uri=uri;
     }
 
-    @Override
     public String apply(HttpServletRequest request) {
         return uri.toString();
     }

web/src/test/java/org/springframework/security/web/headers/HeadersFilterTest.java

@@ -84,7 +84,6 @@ public class HeadersFilterTest {
         private String name;
         private String value;
 
-        @Override
         public Header create(HttpServletRequest request, HttpServletResponse response) {
             return new Header(name, value);
         }