Metacat

Simplify the error handling, and throw the exception once the CN is updated with the new status.

Set the replica status to failed (not invalidated) when we get exceptions trying to read the object bytes. Not much of a difference, but only the CN, in theory, is supposed to be able to set the invalidated status.

Set the replication status to invalidated when we have a localId, but getting the object bytes fails for any reason.

Only call super.create() if there's no localId found on the MN (ie a replica is there from an out of band process).

Get the object inputstream from the local metacat instance using MetacatHandler.get() rather than MN.getReplica() so we don't throw an InvalidToken exception when passing in a null Session. The D1Client object is never used for this local call.

interpret permissions as hierarchical
https://redmine.dataone.org/issues/2150

Use submitLoginFormIntoDivAndReload to replace submitLoginFormIntoDiv js function.

remove flag for independent system metadata replication -- these entries are replicated along with the data/metadata objects or via hazelcast when the actual object is not on the server.

update documentation to reflect changes to replication (client certificate)
http://bugzilla.ecoinformatics.org/show_bug.cgi?id=5516

include SSL settings for client certificate-based replication