Also do not restrict coverage calculation to this class since
the metada functions to test the various configured subclasses.

The protectindexpage test was broken and never changed the
protectindexpage setting, but the logic was also broken so
it always passed and never got past the protected index
page guard in the controller so not a lot of code in the
controller was run.

Also add more tests for the metadata controllers.

Output encoding happens in the view. This prevents the encoded stuff
from ending up in other places, including log files. Also fixes
tests that were broken because of this.

* Add AuthSource Selector - dynamically call an authsource based on policy decision

Add some controllers + tests