See merge request !1676

this only supported http and never supported https, probably nobody is
using this and it makes porting to python3 more complicated

we had a patch to close <input/> elements, but with HTML5 this is no
longer recommended.

template_keep_path_list, template_keep_workflow_path_list and
template_keep_last_workflow_history_only_path_list were not sorted
for no reason

The _getOrderedList approach was not ideal, because the properties were
saved when being displayed, so the typical workflow was:

 1. enter the property as non sorted
 2. click save (property is saved as non sorted)
 3. the page displays the property again as sorted
 4. click save again so that the property is saved as sorted

by sorting the properties at save time, step 1 is enough

This change back the accessors to be "standard" accessors, ie. returning
lists, like every other list accessors, so a few tests and a few scripts
had to be adjusted for the new API.

Lazy loading img are also not loaded, which speed up page rendering.

This should evolve to become a browser-side OAuth2 client.

So every new instance is able to use self-contained oauh2 authentication.
In turn, this triggers atomated migration of a few portal types, which
cause the coding style tests to fail. So commit these as well.

Replace CookieCrumbler's cookie with OAuth2 tokens:
- add the notion of authenticated sessions: period from a login action to
  either a logout or the expiration of tokens
- avoids session fixation (knowing one token does not grant near-permanent
  access to the session)
- reduces the per-request cost of authentication (removes the need to
  compute user's groups, and the need to cache these groups for a fixed
  period).

Also, to reliably open login_form, log out.

This is a simplified version that works well enough for python 2.
For Zope 4 and python 3 we are considering reusing publish.