Disable static method access in OGNL expressions by default

Currently, it is possible to call any static method in OGNL expressions. Unfortunately, there have been several recent cases where Struts allowed a user to execute any OGNL expression, and combined with the ability to call static methods, these security issues have been severe.

First, Struts needs to provide the ability for a user to turn off or on static method access. Second, this feature should be disabled by default as a security precaution.