Thanks Anu Engineer a lot for working on this! I totally did not notice compatibility issues on branch-2. A few comments.
1) xFrameOption and xFrameOptionIsEnabled (of HttpServer2) are declared as static but used as instance variables. Can you make them non-static? Of course, QuotingInputFilter has to be non-static to access them.
2) testHttpResonseContainsXFrameOptions, testHttpResonseContainsDeny and testHttpResonseContainsAllowFrom are the same except the x-frame-option config. You could have a common method that takes x-frame-option as a parameter and does the verification. Then the three test methods can simply call that method with different x-frame-option.
3) The patch touches both HttpServer2 which is in COMMON, and HDFS servers. Can you create a parent jira against COMMON to make HttpServer2 changes, then create a sub task against HDFS of that to make HDFS changes? Other components also uses HttpServer2, such as MR. If needed, we could add more subtasks for each of the components.