fixes security test order

[smoebody]

this pull request fixes the security testing order. Imagine a security-setup like this

  security:
    -
      client_credentials: []
      user_credentials: []
    -
      client_credentials: []

I want to process the security definitions in order so that satisfying client_credentials AND user_credentials always wins.
Appearently this does not resolve reliable until now since the security middleware invokes the security handlers with async.map() so that both OR-sets are tried to resolve in parallel, so that sometimes wins the first, sometimes the second.
In my usecase i save client- and user-credentials to the request-object so that i do not have to do it again in the controller. with this pull request i changed the implementation to work sequentially for the OR-set by using async.mapSeries instead of async.map. this ensures that testing the first set has to finish in order to test the second one. also the second set is never invoked if the first satisfys successfully.

i hope i could make myself clear. feel free to include the docker-stuff. i find it convenient, but not necessary.

[smoebody]

i just saw that this migh be related to #419

[whitlockjc]

The Docker support should also be in a separate commit, just like the changes to the npm scripts. Do you mind taking those out and submitting them in a subsequent pull request?

[whitlockjc]

This could be a separate commit, also "test": "gulp" could be updated to use node node_modules/.bin/gulp if/when you do it.

[smoebody]

I would rather not change the default test-command to explicit call the gulp script. npm should take care of script path resolution.
the reason i do manually for test-debug is because gulp has no option to enable node's debug mode. this is more of a workaround than a reliable solution i think.

[whitlockjc]

In that case, I'm cool with keeping this part as-is.

[smoebody]

ok, this pull request only contains the security order stuff. i made separate pull requests for docker-compose and test-debug, as you wished.

thanks for all the work

[whitlockjc]

Do you mind removing the browser/* changes from the PR? You only changed middleware and those changes should not touch the browser builds. (I assume this is because your npm install installed different versions of the dependencies last used to build the browser binaries.) It likely wouldn't break anything but it's safer to avoid bringing in unnecessary changes.

Thanks for your contribution, and your patience with my review. As soon as you get this taken care of, I'll merge all 3 PRs from you.

[smoebody]

ok, no problem.

[whitlockjc]

Thanks for your help.